linux_dsm_epyc7002/drivers/md
Joe Thornber cebc2de44d dm space map metadata: fix refcount decrement below 0 which caused corruption
This has been a relatively long-standing issue that wasn't nailed down
until Teng-Feng Yang's meticulous bug report to dm-devel on 3/7/2014,
see: http://www.redhat.com/archives/dm-devel/2014-March/msg00021.html

From that report:
  "When decreasing the reference count of a metadata block with its
  reference count equals 3, we will call dm_btree_remove() to remove
  this enrty from the B+tree which keeps the reference count info in
  metadata device.

  The B+tree will try to rebalance the entry of the child nodes in each
  node it traversed, and the rebalance process contains the following
  steps.

  (1) Finding the corresponding children in current node (shadow_current(s))
  (2) Shadow the children block (issue BOP_INC)
  (3) redistribute keys among children, and free children if necessary (issue BOP_DEC)

  Since the update of a metadata block's reference count could be
  recursive, we will stash these reference count update operations in
  smm->uncommitted and then process them in a FILO fashion.

  The problem is that step(3) could free the children which is created
  in step(2), so the BOP_DEC issued in step(3) will be carried out
  before the BOP_INC issued in step(2) since these BOPs will be
  processed in FILO fashion. Once the BOP_DEC from step(3) tries to
  decrease the reference count of newly shadow block, it will report
  failure for its reference equals 0 before decreasing. It looks like we
  can solve this issue by processing these BOPs in a FIFO fashion
  instead of FILO."

Commit 5b564d80 ("dm space map: disallow decrementing a reference count
below zero") changed the code to report an error for this temporary
refcount decrement below zero.  So what was previously a harmless
invalid refcount became a hard failure due to the new error path:

 device-mapper: space map common: unable to decrement a reference count below 0
 device-mapper: thin: 253:6: dm_thin_insert_block() failed: error = -22
 device-mapper: thin: 253:6: switching pool to read-only mode

This bug is in dm persistent-data code that is common to the DM thin and
cache targets.  So any users of those targets should apply this fix.

Fix this by applying recursive space map operations in FIFO order rather
than FILO.

Resolves: https://bugzilla.kernel.org/show_bug.cgi?id=68801

Reported-by: Apollon Oikonomopoulos <apoikos@debian.org>
Reported-by: edwillam1007@gmail.com
Reported-by: Teng-Feng Yang <shinrairis@gmail.com>
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 3.13+
2014-03-07 12:02:47 -05:00
..
bcache Merge branch 'bcache-for-3.14' of git://evilpiepirate.org/~kent/linux-bcache into for-linus 2014-01-30 12:57:55 -07:00
persistent-data dm space map metadata: fix refcount decrement below 0 which caused corruption 2014-03-07 12:02:47 -05:00
bitmap.c kernfs: s/sysfs_dirent/kernfs_node/ and rename its friends accordingly 2013-12-11 15:28:36 -08:00
bitmap.h kernfs: s/sysfs_dirent/kernfs_node/ and rename its friends accordingly 2013-12-11 15:28:36 -08:00
dm-bio-prison.c
dm-bio-prison.h
dm-bio-record.h dm: Refactor for new bio cloning/splitting 2013-11-23 22:33:55 -08:00
dm-bufio.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
dm-bufio.h dm snapshot: use dm-bufio prefetch 2014-01-14 23:23:03 -05:00
dm-builtin.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-cache-block-types.h
dm-cache-metadata.c dm cache metadata: check the metadata version when reading the superblock 2013-11-11 11:37:49 -05:00
dm-cache-metadata.h dm cache: add passthrough mode 2013-11-11 11:37:49 -05:00
dm-cache-policy-cleaner.c
dm-cache-policy-internal.h dm cache: add remove_cblock method to policy interface 2013-11-11 11:37:50 -05:00
dm-cache-policy-mq.c dm cache mq: fix memory allocation failure for large cache devices 2014-02-28 12:18:29 -05:00
dm-cache-policy.c dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-policy.h dm cache: add policy name to status output 2014-01-16 13:44:11 -05:00
dm-cache-target.c dm cache: fix truncation bug when mapping I/O to >2TB fast device 2014-02-28 09:23:02 -05:00
dm-crypt.c block: Convert drivers to immutable biovecs 2013-11-23 22:33:51 -08:00
dm-delay.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
dm-exception-store.c
dm-exception-store.h
dm-flakey.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-io.c dm io: fix I/O to multiple destinations 2014-02-17 11:00:05 -05:00
dm-ioctl.c dm: allow remove to be deferred 2013-11-09 18:20:22 -05:00
dm-kcopyd.c
dm-linear.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-log-userspace-base.c dm log userspace: allow mark requests to piggyback on flush requests 2014-01-21 23:46:27 -05:00
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log.c
dm-mpath.c dm mpath: fix stalls when handling invalid ioctls 2014-02-26 09:44:44 -05:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid1.c dm raid1: fix immutable biovec related BUG when retrying read bio 2014-02-18 10:48:57 -05:00
dm-raid.c
dm-region-hash.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-round-robin.c
dm-service-time.c
dm-snap-persistent.c dm snapshot: fix metadata corruption 2014-03-03 17:58:13 -05:00
dm-snap-transient.c
dm-snap.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
dm-stats.c dm stats: initialize read-only module parameter 2013-12-10 19:13:21 -05:00
dm-stats.h
dm-stripe.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-switch.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
dm-sysfs.c dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
dm-table.c dm table: remove unused buggy code that extends the targets array 2014-01-07 10:11:44 -05:00
dm-target.c
dm-thin-metadata.c dm thin: ensure user takes action to validate data and metadata consistency 2014-03-05 15:25:35 -05:00
dm-thin-metadata.h dm thin: ensure user takes action to validate data and metadata consistency 2014-03-05 15:25:35 -05:00
dm-thin.c dm thin: fix noflush suspend IO queueing 2014-03-05 15:26:59 -05:00
dm-uevent.c
dm-uevent.h
dm-verity.c block: Generic bio chaining 2013-11-23 22:33:56 -08:00
dm-zero.c
dm.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
dm.h dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
faulty.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
Kconfig dm: fix Kconfig indentation 2014-03-03 17:31:07 -05:00
linear.c block: Introduce new bio_split() 2013-11-23 22:33:57 -08:00
linear.h
Makefile dm sysfs: fix a module unload race 2014-01-14 23:23:04 -05:00
md.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
md.h Driver core / sysfs patches for 3.14-rc1 2014-01-20 15:49:44 -08:00
multipath.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
multipath.h
raid0.c block: Introduce new bio_split() 2013-11-23 22:33:57 -08:00
raid0.h
raid1.c md/raid1: restore ability for check and repair to fix read errors. 2014-02-05 12:26:04 +11:00
raid1.h raid1: Rewrite the implementation of iobarrier. 2013-11-19 15:19:18 +11:00
raid5.c md/raid5: Fix CPU hotplug callback registration 2014-02-13 13:46:45 +11:00
raid5.h md update for 3.13. 2013-11-20 13:05:25 -08:00
raid10.c Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block 2014-01-30 11:19:05 -08:00
raid10.h