Commit 34f8ac6d79e5446c6242e4bcb474f152c857c5c6

Authored by Jonathan Brassow
Committed by NeilBrown
1 parent 307729c8bc

Prevent DM RAID from loading bitmap twice.

The life cycle of a device-mapper target is:
1) create
2) resume
3) suspend
*) possibly repeat from 2
4) destroy

The dm-raid target is unconditionally calling MD's bitmap_load function upon
every resume.  If steps 2 & 3 above are repeated, bitmap_load is called
multiple times.  It is only written to be called once; otherwise, it allocates
new memory for the bitmap (without freeing the old) and incrementing the number
of pages it thinks it has without zeroing first.  This ultimately leads to
access beyond allocated memory and lost memory.

Simply avoiding the bitmap_load call upon resume is not sufficient.  If the
target was suspended while the initial recovery was only partially complete,
it needs to be restarted when the target is resumed.  This is why
'md_wakeup_thread' is called before issuing the 'mddev_resume'.

Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.de>

Showing 1 changed file with 9 additions and 3 deletions Side-by-side Diff

drivers/md/dm-raid.c
... ... @@ -56,7 +56,8 @@
56 56 struct raid_set {
57 57 struct dm_target *ti;
58 58  
59   - uint64_t print_flags;
  59 + uint32_t bitmap_loaded;
  60 + uint32_t print_flags;
60 61  
61 62 struct mddev md;
62 63 struct raid_type *raid_type;
... ... @@ -1085,7 +1086,7 @@
1085 1086 raid_param_cnt += 2;
1086 1087 }
1087 1088  
1088   - raid_param_cnt += (hweight64(rs->print_flags & ~DMPF_REBUILD) * 2);
  1089 + raid_param_cnt += (hweight32(rs->print_flags & ~DMPF_REBUILD) * 2);
1089 1090 if (rs->print_flags & (DMPF_SYNC | DMPF_NOSYNC))
1090 1091 raid_param_cnt--;
1091 1092  
... ... @@ -1197,7 +1198,12 @@
1197 1198 {
1198 1199 struct raid_set *rs = ti->private;
1199 1200  
1200   - bitmap_load(&rs->md);
  1201 + if (!rs->bitmap_loaded) {
  1202 + bitmap_load(&rs->md);
  1203 + rs->bitmap_loaded = 1;
  1204 + } else
  1205 + md_wakeup_thread(rs->md.thread);
  1206 +
1201 1207 mddev_resume(&rs->md);
1202 1208 }
1203 1209