-stable review patch. If anyone has any objections, please let us know. --------------------- From: Mikulas Patocka upstream commit: 35bf659b008e83e725dcd30f542e38461dbb867c We need to check if the exception was completed after dropping the lock. After regaining the lock, __find_pending_exception checks if the exception was already placed into &s->pending hash. But we don't check if the exception was already completed and placed into &s->complete hash. If the process waiting in alloc_pending_exception was delayed at this point because of a scheduling latency and the exception was meanwhile completed, we'd miss that and allocate another pending exception for already completed chunk. It would lead to a situation where two records for the same chunk exist and potential data corruption because multiple snapshot I/Os to the affected chunk could be redirected to different locations in the snapshot. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon Signed-off-by: Chris Wright --- drivers/md/dm-snap.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) --- a/drivers/md/dm-snap.c +++ b/drivers/md/dm-snap.c @@ -1080,6 +1080,13 @@ static int snapshot_map(struct dm_target goto out_unlock; } + e = lookup_exception(&s->complete, chunk); + if (e) { + free_pending_exception(pe); + remap_exception(s, e, bio, chunk); + goto out_unlock; + } + pe = __find_pending_exception(s, pe, chunk); if (!pe) { __invalidate_snapshot(s, -ENOMEM); @@ -1226,6 +1233,12 @@ static int __origin_write(struct list_he goto next_snapshot; } + e = lookup_exception(&snap->complete, chunk); + if (e) { + free_pending_exception(pe); + goto next_snapshot; + } + pe = __find_pending_exception(snap, pe, chunk); if (!pe) { __invalidate_snapshot(snap, -ENOMEM); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/