iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent DM RAID from loading bitmap twice.

Browse Source 
The life cycle of a device-mapper target is:
1) create
2) resume
3) suspend
*) possibly repeat from 2
4) destroy

The dm-raid target is unconditionally calling MD's bitmap_load function upon
every resume.  If steps 2 & 3 above are repeated, bitmap_load is called
multiple times.  It is only written to be called once; otherwise, it allocates
new memory for the bitmap (without freeing the old) and incrementing the number
of pages it thinks it has without zeroing first.  This ultimately leads to
access beyond allocated memory and lost memory.

Simply avoiding the bitmap_load call upon resume is not sufficient.  If the
target was suspended while the initial recovery was only partially complete,
it needs to be restarted when the target is resumed.  This is why
'md_wakeup_thread' is called before issuing the 'mddev_resume'.

Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.de>
This commit is contained in:
Jonathan Brassow 2012-01-27 14:53:53 -06:00 committed by NeilBrown
parent 307729c8bc
commit 34f8ac6d79
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/md/dm-raid.c
View File

@ -56,7 +56,8 @@ struct raid_dev {
struct raid_set {
struct dm_target *ti;
uint64_t print_flags;
uint32_t bitmap_loaded;
uint32_t print_flags;
struct mddev md;
struct raid_type *raid_type;
@ -1085,7 +1086,7 @@ static int raid_status(struct dm_target *ti, status_type_t type,
raid_param_cnt += 2;
}
raid_param_cnt += (hweight64(rs->print_flags & ~DMPF_REBUILD) * 2);
raid_param_cnt += (hweight32(rs->print_flags & ~DMPF_REBUILD) * 2);
if (rs->print_flags & (DMPF_SYNC | DMPF_NOSYNC))
raid_param_cnt--;
@ -1197,7 +1198,12 @@ static void raid_resume(struct dm_target *ti)
{
struct raid_set *rs = ti->private;
if (!rs->bitmap_loaded) {
bitmap_load(&rs->md);
rs->bitmap_loaded = 1;
} else
md_wakeup_thread(rs->md.thread);
mddev_resume(&rs->md);
}