linux-toradex.git/drivers/md/dm-thin.c, branch v4.9.44

dm thin: do not queue freed thin mapping for next stage processing

2017-07-05T12:40:18+00:00

commit 00a0ea33b495ee6149bf5a77ac5807ce87323abb upstream.

process_prepared_discard_passdown_pt1() should cleanup
dm_thin_new_mapping in cases of error.

dm_pool_inc_data_range() can fail trying to get a block reference:

metadata operation 'dm_pool_inc_data_range' failed: error = -61

When dm_pool_inc_data_range() fails, dm thin aborts current metadata
transaction and marks pool as PM_READ_ONLY. Memory for thin mapping
is released as well. However, current thin mapping will be queued
onto next stage as part of queue_passdown_pt2() or passdown_endio().
This dangling thin mapping memory when processed and accessed in
next stage will lead to device mapper crashing.

Code flow without fix:
-> process_prepared_discard_passdown_pt1(m)
   -> dm_thin_remove_range()
   -> discard passdown
      --> passdown_endio(m) queues m onto next stage
   -> dm_pool_inc_data_range() fails, frees memory m
            but does not remove it from next stage queue

-> process_prepared_discard_passdown_pt2(m)
   -> processes freed memory m and crashes

One such stack:

Call Trace:
[] dm_cell_release_no_holder+0x2f/0x70 [dm_bio_prison]
[] cell_defer_no_holder+0x3c/0x80 [dm_thin_pool]
[] process_prepared_discard_passdown_pt2+0x4b/0x90 [dm_thin_pool]
[] process_prepared+0x81/0xa0 [dm_thin_pool]
[] do_worker+0xc5/0x820 [dm_thin_pool]
[] ? __schedule+0x244/0x680
[] ? pwq_activate_delayed_work+0x42/0xb0
[] process_one_work+0x153/0x3f0
[] worker_thread+0x12b/0x4b0
[] ? rescuer_thread+0x350/0x350
[] kthread+0xca/0xe0
[] ? kthread_park+0x60/0x60
[] ret_from_fork+0x25/0x30

The fix is to first take the block ref count for discarded block and
then do a passdown discard of this block. If block ref count fails,
then bail out aborting current metadata transaction, mark pool as
PM_READ_ONLY and also free current thin mapping memory (existing error
handling code) without queueing this thin mapping onto next stage of
processing. If block ref count succeeds, then passdown discard of this
block. Discard callback of passdown_endio() will queue this thin mapping
onto next stage of processing.

Code flow with fix:
-> process_prepared_discard_passdown_pt1(m)
   -> dm_thin_remove_range()
   -> dm_pool_inc_data_range()
      --> if fails, free memory m and bail out
   -> discard passdown
      --> passdown_endio(m) queues m onto next stage

Reviewed-by: Eduardo Valentin 
Reviewed-by: Cristian Gafton 
Reviewed-by: Anchal Agarwal 
Signed-off-by: Vallish Vaidyeshwara 
Reviewed-by: Joe Thornber 
Signed-off-by: Mike Snitzer 
Signed-off-by: Greg Kroah-Hartman

dm thin: fix a memory leak when passing discard bio down

2017-05-20T12:28:37+00:00

commit 948f581a53b704b984aa20df009f0a2b4cf7f907 upstream.

dm-thin does not free the discard_parent bio after all chained sub
bios finished. The following kmemleak report could be observed after
pool with discard_passdown option processes discard bios in
linux v4.11-rc7. To fix this, we drop the discard_parent bio reference
when its endio (passdown_endio) called.

unreferenced object 0xffff8803d6b29700 (size 256):
  comm "kworker/u8:0", pid 30349, jiffies 4379504020 (age 143002.776s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    01 00 00 00 00 00 00 f0 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x49/0xa0
    [] kmem_cache_alloc+0xb4/0x100
    [] mempool_alloc_slab+0x10/0x20
    [] mempool_alloc+0x55/0x150
    [] bio_alloc_bioset+0xb9/0x260
    [] process_prepared_discard_passdown_pt1+0x40/0x1c0 [dm_thin_pool]
    [] break_up_discard_bio+0x1a9/0x200 [dm_thin_pool]
    [] process_discard_cell_passdown+0x24/0x40 [dm_thin_pool]
    [] process_discard_bio+0xdd/0xf0 [dm_thin_pool]
    [] do_worker+0xa76/0xd50 [dm_thin_pool]
    [] process_one_work+0x139/0x370
    [] worker_thread+0x61/0x450
    [] kthread+0xd6/0xf0
    [] ret_from_fork+0x3f/0x70
    [] 0xffffffffffffffff

Signed-off-by: Dennis Yang 
Signed-off-by: Mike Snitzer 
Signed-off-by: Greg Kroah-Hartman

block: rename bio bi_rw to bi_opf

2016-08-07T20:41:02+00:00

Since commit 63a4cc24867d, bio->bi_rw contains flags in the lower
portion and the op code in the higher portions. This means that
old code that relies on manually setting bi_rw is most likely
going to be broken. Instead of letting that brokeness linger,
rename the member, to force old and out-of-tree code to break
at compile time instead of at runtime.

No intended functional changes in this commit.

Signed-off-by: Jens Axboe

dm thin: fix a race condition between discarding and provisioning a block

2016-07-20T16:43:35+00:00

The discard passdown was being issued after the block was unmapped,
which meant the block could be reprovisioned whilst the passdown discard
was still in flight.

We can only identify unshared blocks (safe to do a passdown a discard
to) once they're unmapped and their ref count hits zero.  Block ref
counts are now used to guard against concurrent allocation of these
blocks that are being discarded.  So now we unmap the block, issue
passdown discards, and the immediately increment ref counts for regions
that have been discarded via passed down (this is safe because
allocation occurs within the same thread).  We then decrement ref counts
once the passdown discard IO is complete -- signaling these blocks may
now be allocated.

This fixes the potential for corruption that was reported here:
https://www.redhat.com/archives/dm-devel/2016-June/msg00311.html

Reported-by: Dennis Yang 
Signed-off-by: Joe Thornber 
Signed-off-by: Mike Snitzer

block, drivers, fs: rename REQ_FLUSH to REQ_PREFLUSH

2016-06-07T19:41:38+00:00

To avoid confusion between REQ_OP_FLUSH, which is handled by
request_fn drivers, and upper layers requesting the block layer
perform a flush sequence along with possibly a WRITE, this patch
renames REQ_FLUSH to REQ_PREFLUSH.

Signed-off-by: Mike Christie 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Jens Axboe

dm: use bio op accessors

2016-06-07T19:41:38+00:00

Separate the op from the rq_flag_bits and have dm
set/get the bio using bio_set_op_attrs/bio_op.

Signed-off-by: Mike Christie 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Jens Axboe

block discard: use bio set op accessor

2016-06-07T19:41:38+00:00

This converts the block issue discard helper and users to use
the bio_set_op_attrs accessor and only pass in the operation flags
like REQ_SEQURE.

Signed-off-by: Mike Christie 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Jens Axboe

block/fs/drivers: remove rw argument from submit_bio

2016-06-07T19:41:38+00:00

This has callers of submit_bio/submit_bio_wait set the bio->bi_rw
instead of passing it in. This makes that use the same as
generic_make_request and how we set the other bio fields.

Signed-off-by: Mike Christie 

Fixed up fs/ext4/crypto.c

Signed-off-by: Jens Axboe

dm thin: unroll issue_discard() to create longer discard bio chains

2016-05-13T13:04:20+00:00

There is little benefit to doing this but it does structure DM thinp's
code to more cleanly use the __blkdev_issue_discard() interface --
particularly in passdown_double_checking_shared_status().

Signed-off-by: Joe Thornber 
Signed-off-by: Mike Snitzer

dm thin: use __blkdev_issue_discard for async discard support

2016-05-13T13:03:52+00:00

With commit 38f25255330 ("block: add __blkdev_issue_discard") DM thinp
no longer needs to carry its own async discard method.

Signed-off-by: Mike Snitzer 
Acked-by: Joe Thornber 
Reviewed-by: Christoph Hellwig