forked from Minki/linux
3f77316de0
This patch separates the device deletion code from dm_put()
to make sure the deletion happens in the process context.
By this patch, device deletion always occurs in an ioctl (process)
context and dm_put() can be called in interrupt context.
As a result, the request-based dm's bad dm_put() usage pointed out
by Mikulas below disappears.
http://marc.info/?l=dm-devel&m=126699981019735&w=2
Without this patch, I confirmed there is a case to crash the system:
dm_put() => dm_table_destroy() => vfree() => BUG_ON(in_interrupt())
Some more backgrounds and details:
In request-based dm, a device opener can remove a mapped_device
while the last request is still completing, because bios in the last
request complete first and then the device opener can close and remove
the mapped_device before the last request completes:
CPU0 CPU1
=================================================================
<<INTERRUPT>>
blk_end_request_all(clone_rq)
blk_update_request(clone_rq)
bio_endio(clone_bio) == end_clone_bio
blk_update_request(orig_rq)
bio_endio(orig_bio)
<<I/O completed>>
dm_blk_close()
dev_remove()
dm_put(md)
<<Free md>>
blk_finish_request(clone_rq)
....
dm_end_request(clone_rq)
free_rq_clone(clone_rq)
blk_end_request_all(orig_rq)
rq_completed(md)
So request-based dm used dm_get()/dm_put() to hold md for each I/O
until its request completion handling is fully done.
However, the final dm_put() can call the device deletion code which
must not be run in interrupt context and may cause kernel panic.
To solve the problem, this patch moves the device deletion code,
dm_destroy(), to predetermined places that is actually deleting
the mapped_device in ioctl (process) context, and changes dm_put()
just to decrement the reference count of the mapped_device.
By this change, dm_put() can be used in any context and the symmetric
model below is introduced:
dm_create(): create a mapped_device
dm_destroy(): destroy a mapped_device
dm_get(): increment the reference count of a mapped_device
dm_put(): decrement the reference count of a mapped_device
dm_destroy() waits for all references of the mapped_device to disappear,
then deletes the mapped_device.
dm_destroy() uses active waiting with msleep(1), since deleting
the mapped_device isn't performance-critical task.
And since at this point, nobody opens the mapped_device and no new
reference will be taken, the pending counts are just for racing
completing activity and will eventually decrease to zero.
For the unlikely case of the forced module unload, dm_destroy_immediate(),
which doesn't wait and forcibly deletes the mapped_device, is also
introduced and used in dm_hash_remove_all(). Otherwise, "rmmod -f"
may be stuck and never return.
And now, because the mapped_device is deleted at this point, subsequent
accesses to the mapped_device may cause NULL pointer references.
Cc: stable@kernel.org
Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
149 lines
4.1 KiB
C
149 lines
4.1 KiB
C
/*
|
|
* Internal header file for device mapper
|
|
*
|
|
* Copyright (C) 2001, 2002 Sistina Software
|
|
* Copyright (C) 2004-2006 Red Hat, Inc. All rights reserved.
|
|
*
|
|
* This file is released under the LGPL.
|
|
*/
|
|
|
|
#ifndef DM_INTERNAL_H
|
|
#define DM_INTERNAL_H
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/device-mapper.h>
|
|
#include <linux/list.h>
|
|
#include <linux/blkdev.h>
|
|
#include <linux/hdreg.h>
|
|
|
|
/*
|
|
* Suspend feature flags
|
|
*/
|
|
#define DM_SUSPEND_LOCKFS_FLAG (1 << 0)
|
|
#define DM_SUSPEND_NOFLUSH_FLAG (1 << 1)
|
|
|
|
/*
|
|
* Type of table and mapped_device's mempool
|
|
*/
|
|
#define DM_TYPE_NONE 0
|
|
#define DM_TYPE_BIO_BASED 1
|
|
#define DM_TYPE_REQUEST_BASED 2
|
|
|
|
/*
|
|
* List of devices that a metadevice uses and should open/close.
|
|
*/
|
|
struct dm_dev_internal {
|
|
struct list_head list;
|
|
atomic_t count;
|
|
struct dm_dev dm_dev;
|
|
};
|
|
|
|
struct dm_table;
|
|
struct dm_md_mempools;
|
|
|
|
/*-----------------------------------------------------------------
|
|
* Internal table functions.
|
|
*---------------------------------------------------------------*/
|
|
void dm_table_destroy(struct dm_table *t);
|
|
void dm_table_event_callback(struct dm_table *t,
|
|
void (*fn)(void *), void *context);
|
|
struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index);
|
|
struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector);
|
|
int dm_calculate_queue_limits(struct dm_table *table,
|
|
struct queue_limits *limits);
|
|
void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
|
|
struct queue_limits *limits);
|
|
struct list_head *dm_table_get_devices(struct dm_table *t);
|
|
void dm_table_presuspend_targets(struct dm_table *t);
|
|
void dm_table_postsuspend_targets(struct dm_table *t);
|
|
int dm_table_resume_targets(struct dm_table *t);
|
|
int dm_table_any_congested(struct dm_table *t, int bdi_bits);
|
|
int dm_table_any_busy_target(struct dm_table *t);
|
|
int dm_table_set_type(struct dm_table *t);
|
|
unsigned dm_table_get_type(struct dm_table *t);
|
|
bool dm_table_request_based(struct dm_table *t);
|
|
int dm_table_alloc_md_mempools(struct dm_table *t);
|
|
void dm_table_free_md_mempools(struct dm_table *t);
|
|
struct dm_md_mempools *dm_table_get_md_mempools(struct dm_table *t);
|
|
|
|
/*
|
|
* To check the return value from dm_table_find_target().
|
|
*/
|
|
#define dm_target_is_valid(t) ((t)->table)
|
|
|
|
/*
|
|
* To check whether the target type is request-based or not (bio-based).
|
|
*/
|
|
#define dm_target_request_based(t) ((t)->type->map_rq != NULL)
|
|
|
|
/*-----------------------------------------------------------------
|
|
* A registry of target types.
|
|
*---------------------------------------------------------------*/
|
|
int dm_target_init(void);
|
|
void dm_target_exit(void);
|
|
struct target_type *dm_get_target_type(const char *name);
|
|
void dm_put_target_type(struct target_type *tt);
|
|
int dm_target_iterate(void (*iter_func)(struct target_type *tt,
|
|
void *param), void *param);
|
|
|
|
int dm_split_args(int *argc, char ***argvp, char *input);
|
|
|
|
/*
|
|
* Is this mapped_device being deleted?
|
|
*/
|
|
int dm_deleting_md(struct mapped_device *md);
|
|
|
|
/*
|
|
* Is this mapped_device suspended?
|
|
*/
|
|
int dm_suspended_md(struct mapped_device *md);
|
|
|
|
/*
|
|
* The device-mapper can be driven through one of two interfaces;
|
|
* ioctl or filesystem, depending which patch you have applied.
|
|
*/
|
|
int dm_interface_init(void);
|
|
void dm_interface_exit(void);
|
|
|
|
/*
|
|
* sysfs interface
|
|
*/
|
|
int dm_sysfs_init(struct mapped_device *md);
|
|
void dm_sysfs_exit(struct mapped_device *md);
|
|
struct kobject *dm_kobject(struct mapped_device *md);
|
|
struct mapped_device *dm_get_from_kobject(struct kobject *kobj);
|
|
|
|
/*
|
|
* Targets for linear and striped mappings
|
|
*/
|
|
int dm_linear_init(void);
|
|
void dm_linear_exit(void);
|
|
|
|
int dm_stripe_init(void);
|
|
void dm_stripe_exit(void);
|
|
|
|
/*
|
|
* mapped_device operations
|
|
*/
|
|
void dm_destroy(struct mapped_device *md);
|
|
void dm_destroy_immediate(struct mapped_device *md);
|
|
int dm_open_count(struct mapped_device *md);
|
|
int dm_lock_for_deletion(struct mapped_device *md);
|
|
|
|
int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
|
|
unsigned cookie);
|
|
|
|
int dm_io_init(void);
|
|
void dm_io_exit(void);
|
|
|
|
int dm_kcopyd_init(void);
|
|
void dm_kcopyd_exit(void);
|
|
|
|
/*
|
|
* Mempool operations
|
|
*/
|
|
struct dm_md_mempools *dm_alloc_md_mempools(unsigned type);
|
|
void dm_free_md_mempools(struct dm_md_mempools *pools);
|
|
|
|
#endif
|