dm: table detect io beyond device

Patch 512875bd9661368da6f993205a61213b79ba1df0 in mainline.

This patch fixes a panic on shrinking a DM device if there is
outstanding I/O to the part of the device that is being removed.
(Normally this doesn't happen - a filesystem would be resized first,
for example.)

The bug is that __clone_and_map() assumes dm_table_find_target()
always returns a valid pointer.  It may fail if a bio arrives from the
block layer but its target sector is no longer included in the DM
btree.

This patch appends an empty entry to table->targets[] which will
be returned by a lookup beyond the end of the device.

After calling dm_table_find_target(), __clone_and_map() and target_message()
check for this condition using
dm_target_is_valid().

Sample test script to trigger oops:

#!/bin/bash

FILE=$(mktemp)
LODEV=$(losetup -f)
MAP=$(basename ${FILE})
SIZE=4M

dd if=/dev/zero of=${FILE} bs=${SIZE} count=1
losetup ${LODEV} ${FILE}

echo "0 $(blockdev --getsz ${LODEV}) linear ${LODEV} 0" |dmsetup create ${MAP}
dmsetup suspend ${MAP}
echo "0 1 linear ${LODEV} 0" |dmsetup load ${MAP}
dd if=/dev/zero of=/dev/mapper/${MAP} bs=${SIZE} count=1 &
echo "Wait til dd push some I/O"
sleep 5
dmsetup resume ${MAP}

Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index b441d82c338a32156a6d270eaa1f7cb5553178f9..8a4f63b13b279d844373f44eaf6f75a0bc05abae 100644 (file)
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1250,21 +1250,17 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
        if (!table)
                goto out_argv;
 
-       if (tmsg->sector >= dm_table_get_size(table)) {
+       ti = dm_table_find_target(table, tmsg->sector);
+       if (!dm_target_is_valid(ti)) {
                DMWARN("Target message sector outside device.");
                r = -EINVAL;
-               goto out_table;
-       }
-
-       ti = dm_table_find_target(table, tmsg->sector);
-       if (ti->type->message)
+       } else if (ti->type->message)
                r = ti->type->message(ti, argc, argv);
        else {
                DMWARN("Target type does not support messages");
                r = -EINVAL;
        }
 
- out_table:
        dm_table_put(table);
  out_argv:
        kfree(argv);

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 2bcde5798b5a6c27dc9b07b6ea9325a88dfdf5f8..72d2250e1575da7e3c413b4588b89fbe6512a34f 100644 (file)
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -187,8 +187,10 @@ static int alloc_targets(struct dm_table *t, unsigned int num)
 
        /*
         * Allocate both the target array and offset array at once.
+        * Append an empty entry to catch sectors beyond the end of
+        * the device.
         */
-       n_highs = (sector_t *) dm_vcalloc(num, sizeof(struct dm_target) +
+       n_highs = (sector_t *) dm_vcalloc(num + 1, sizeof(struct dm_target) +
                                          sizeof(sector_t));
        if (!n_highs)
                return -ENOMEM;
@@ -862,6 +864,9 @@ struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index)
 
 /*
  * Search the btree for the correct target.
+ *
+ * Caller should check returned pointer with dm_target_is_valid()
+ * to trap I/O beyond end of device.
  */
 struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
 {

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 998d4502a039844680a1747485210e4c848c03e9..fac09d52535a47bdbdc014464d51a9ee62a9fa5e 100644 (file)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -663,13 +663,19 @@ static struct bio *clone_bio(struct bio *bio, sector_t sector,
        return clone;
 }
 
-static void __clone_and_map(struct clone_info *ci)
+static int __clone_and_map(struct clone_info *ci)
 {
        struct bio *clone, *bio = ci->bio;
-       struct dm_target *ti = dm_table_find_target(ci->map, ci->sector);
-       sector_t len = 0, max = max_io_len(ci->md, ci->sector, ti);
+       struct dm_target *ti;
+       sector_t len = 0, max;
        struct dm_target_io *tio;
 
+       ti = dm_table_find_target(ci->map, ci->sector);
+       if (!dm_target_is_valid(ti))
+               return -EIO;
+
+       max = max_io_len(ci->md, ci->sector, ti);
+
        /*
         * Allocate a target io object.
         */
@@ -727,6 +733,9 @@ static void __clone_and_map(struct clone_info *ci)
                do {
                        if (offset) {
                                ti = dm_table_find_target(ci->map, ci->sector);
+                               if (!dm_target_is_valid(ti))
+                                       return -EIO;
+
                                max = max_io_len(ci->md, ci->sector, ti);
 
                                tio = alloc_tio(ci->md);
@@ -750,6 +759,8 @@ static void __clone_and_map(struct clone_info *ci)
 
                ci->idx++;
        }
+
+       return 0;
 }
 
 /*
@@ -758,6 +769,7 @@ static void __clone_and_map(struct clone_info *ci)
 static void __split_bio(struct mapped_device *md, struct bio *bio)
 {
        struct clone_info ci;
+       int error = 0;
 
        ci.map = dm_get_table(md);
        if (!ci.map) {
@@ -777,11 +789,11 @@ static void __split_bio(struct mapped_device *md, struct bio *bio)
        ci.idx = bio->bi_idx;
 
        start_io_acct(ci.io);
-       while (ci.sector_count)
-               __clone_and_map(&ci);
+       while (ci.sector_count && !error)
+               error = __clone_and_map(&ci);
 
        /* drop the extra reference count */
-       dec_pending(ci.io, 0);
+       dec_pending(ci.io, error);
        dm_table_put(ci.map);
 }
 /*-----------------------------------------------------------------

diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 462ee652a89015c94490d6500b3e8f879fd8de46..07298a381d50a62599a083b86363489680f06529 100644 (file)
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -113,6 +113,11 @@ int dm_table_any_congested(struct dm_table *t, int bdi_bits);
 void dm_table_unplug_all(struct dm_table *t);
 int dm_table_flush_all(struct dm_table *t);
 
+/*
+ * To check the return value from dm_table_find_target().
+ */
+#define dm_target_is_valid(t) ((t)->table)
+
 /*-----------------------------------------------------------------
  * A registry of target types.
  *---------------------------------------------------------------*/