diff options
| author | Jun'ichi Nomura <j-nomura@ce.jp.nec.com> | 2007-12-13 17:15:25 +0300 |
|---|---|---|
| committer | Alasdair G Kergon <agk@redhat.com> | 2007-12-20 20:32:08 +0300 |
| commit | 512875bd9661368da6f993205a61213b79ba1df0 (patch) | |
| tree | 7a2e010060b6233cd02e2e36b62f5dcaa96c2c36 /drivers/md/dm-table.c | |
| parent | fbdcf18df73758b2e187ab94678b30cd5f6ff9f9 (diff) | |
| download | linux-512875bd9661368da6f993205a61213b79ba1df0.tar.xz | |
dm: table detect io beyond device
This patch fixes a panic on shrinking a DM device if there is
outstanding I/O to the part of the device that is being removed.
(Normally this doesn't happen - a filesystem would be resized first,
for example.)
The bug is that __clone_and_map() assumes dm_table_find_target()
always returns a valid pointer. It may fail if a bio arrives from the
block layer but its target sector is no longer included in the DM
btree.
This patch appends an empty entry to table->targets[] which will
be returned by a lookup beyond the end of the device.
After calling dm_table_find_target(), __clone_and_map() and target_message()
check for this condition using
dm_target_is_valid().
Sample test script to trigger oops:
Diffstat (limited to 'drivers/md/dm-table.c')
| -rw-r--r-- | drivers/md/dm-table.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c index e298d8d11f24..f3f952e347ed 100644 --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -189,8 +189,10 @@ static int alloc_targets(struct dm_table *t, unsigned int num) /* * Allocate both the target array and offset array at once. + * Append an empty entry to catch sectors beyond the end of + * the device. */ - n_highs = (sector_t *) dm_vcalloc(num, sizeof(struct dm_target) + + n_highs = (sector_t *) dm_vcalloc(num + 1, sizeof(struct dm_target) + sizeof(sector_t)); if (!n_highs) return -ENOMEM; @@ -867,6 +869,9 @@ struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index) /* * Search the btree for the correct target. + * + * Caller should check returned pointer with dm_target_is_valid() + * to trap I/O beyond end of device. */ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector) { |