Attachment 314571 Details for Bug 459337 – PATCH 2/2 --- fix this bug

[patch] PATCH 2/2 --- fix this bug

linux-2.6.18-dm-snapshot-fix-race-during-exception-creation.patch (text/plain), 1.92 KB, created by Mikuláš Patočka on 2008-08-19 21:01:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mikuláš Patočka

Created: 2008-08-19 21:01:30 UTC

Size: 1.92 KB

patch

obsolete

>upstream commit: a8d41b59f3f5a7ac19452ef442a7fc1b5fa17366 (2.6.27-rc1)
>
>dm snapshot: fix race during exception creation
>
>Fix a race condition that returns incorrect data when a write causes an
>exception to be allocated whilst a read is still in flight.
>
>The race condition happens as follows:
>* A read to non-reallocated sector in the snapshot is submitted so that the
>  read is routed to the original device.
>* A write to the original device is submitted. The write causes an exception
>  that reallocates the block.  The write proceeds.
>* The original read is dequeued and reads the wrong data.
>
>This race can be triggered with CFQ scheduler and one thread writing and
>multiple threads reading simultaneously.
>
>diff -p -u -r linux-2.6.18.x86_64.p5/drivers/md/dm-snap.c linux-2.6.18.x86_64/drivers/md/dm-snap.c
>--- linux-2.6.18.x86_64.p5/drivers/md/dm-snap.c	2008-08-19 03:45:17.000000000 +0200
>+++ linux-2.6.18.x86_64/drivers/md/dm-snap.c	2008-08-19 04:03:31.000000000 +0200
>@@ -133,6 +133,27 @@ static void stop_tracking_chunk(struct d
> 	mempool_free(c, s->tracked_chunk_pool);
> }
> 
>+static int __chunk_is_tracked(struct dm_snapshot *s, chunk_t chunk)
>+{
>+	struct dm_snap_tracked_chunk *c;
>+	struct hlist_node *hn;
>+	int found = 0;
>+
>+	spin_lock_irq(&s->tracked_chunk_lock);
>+
>+	hlist_for_each_entry(c, hn,
>+	    &s->tracked_chunk_hash[DM_TRACKED_CHUNK_HASH(chunk)], node) {
>+		if (c->chunk == chunk) {
>+			found = 1;
>+			break;
>+		}
>+	}
>+
>+	spin_unlock_irq(&s->tracked_chunk_lock);
>+
>+	return found;
>+}
>+
> /*
>  * One of these per registered origin, held in the snapshot_origins hash
>  */
>@@ -843,6 +864,13 @@ static void pending_complete(struct pend
> 	}
> 
> 	/*
>+	 * Check for conflicting reads. This is extremely improbable,
>+	 * so yield() is sufficient and there is no need for a wait queue.
>+	 */
>+	while (__chunk_is_tracked(s, pe->e.old_chunk))
>+		yield();
>+
>+	/*
> 	 * Add a proper exception, and remove the
> 	 * in-flight exception from the list.
> 	 */

Actions: View | Diff

Attachments on bug 459337: 314570 | 314571 | 314572 | 314573