Skip to contentSkip to conversation

2.6.12-rc6: fix rh_dec()/rh_inc() race in dm-raid1.c

PATCH In review Jun'ichi Nomura 2 participants 4 messages Jun 16, 2005 – Jun 27, 2005 Device mapper

lore
Share & tools
lore

Jun'ichi Nomura

author
#0 lore raw

PATCH 1/1 2.6.12-rc6: fix rh_dec()/rh_inc() race in dm-raid1.c

Hello,

Attached patch fixes the another bug in dm-raid1.c that the dirty region may stay in or be moved to clean list and freed while in use.

It happens as follows:

CPU0 CPU1
------------------------------------------------------------------------------
rh_dec()
if (atomic_dec_and_test(pending))
<the region is still marked dirty>
rh_inc()
if the region is clean
mark the region dirty and remove from clean list
mark the region clean
and move to clean list
atomic_inc(pending)

At this stage, the region is in clean list and will be mistakenly reclaimed by rh_update_states() later.

Signed-off-by Jun'ichi Nomura <[email protected]>
drivers/md/dm-raid1.c renamed from drivers/md/dm-raid1.c.orig +9 -3
@@ -375,16 +380,18 @@ static void rh_inc(struct region_hash *r
 
 	read_lock(&rh->hash_lock);
 	reg = __rh_find(rh, region);
+
+	atomic_inc(&reg->pending);
+
+	spin_lock_irq(&rh->region_lock);
 	if (reg->state == RH_CLEAN) {
 		rh->log->type->mark_region(rh->log, reg->key);
 
-		spin_lock_irq(&rh->region_lock);
 		reg->state = RH_DIRTY;
 		list_del_init(&reg->list);	/* take off the clean list */
-		spin_unlock_irq(&rh->region_lock);
 	}
+	spin_unlock_irq(&rh->region_lock);
 
-	atomic_inc(&reg->pending);
 	read_unlock(&rh->hash_lock);
 }
 

@@ -408,6 +414,10 @@ static void rh_dec(struct region_hash *r
 
 	if (atomic_dec_and_test(&reg->pending)) {
 		spin_lock_irqsave(&rh->region_lock, flags);
+		if (atomic_read(&reg->pending)) { /* check race */
+			spin_unlock_irqrestore(&rh->region_lock, flags);
+			return;
+		}
 		if (reg->state == RH_RECOVERING) {
 			list_add_tail(&reg->list, &rh->quiesced_regions);
 		} else {
#1 lore raw

could this be solved by doing your patch in rh_dec and just moving the atomic_inc in rh_inc? The reason I ask is that the mark_region log call can block.

brassow

Quoted 69 lines · Jun'ichi Nomura

Hello,

Attached patch fixes the another bug in dm-raid1.c that the dirty region may stay in or be moved to clean list and freed while in use.

It happens as follows:

CPU0 CPU1

-----------------------------------------------------------------------
-------
rh_dec()
if (atomic_dec_and_test(pending))
<the region is still marked dirty>
rh_inc()
if the region is clean
mark the region dirty and remove from clean
list
mark the region clean
and move to clean list
atomic_inc(pending)

At this stage, the region is in clean list and will be mistakenly reclaimed by rh_update_states() later.

Signed-off-by Jun'ichi Nomura <[email protected]>

--- kernel/drivers/md/dm-raid1.c.orig 2005-06-16 07:13:50.610325768
-0400
+++ kernel/drivers/md/dm-raid1.c 2005-06-16 10:34:12.510719112 -0400

drivers/md/dm-raid1.c renamed from drivers/md/dm-raid1.c.orig +9 -4
@@ -375,16 +380,18 @@ static void rh_inc(struct region_hash *r
 
 	read_lock(&rh->hash_lock);
 	reg = __rh_find(rh, region);
+
+	atomic_inc(&reg->pending);
+
+	spin_lock_irq(&rh->region_lock);
 	if (reg->state == RH_CLEAN) {
 		rh->log->type->mark_region(rh->log, reg->key);
 
-		spin_lock_irq(&rh->region_lock);
 		reg->state = RH_DIRTY;
 		list_del_init(&reg->list);	/* take off the clean list */
-		spin_unlock_irq(&rh->region_lock);
 	}
+	spin_unlock_irq(&rh->region_lock);
 
-	atomic_inc(&reg->pending);
 	read_unlock(&rh->hash_lock);
 }
 

@@ -408,6 +414,10 @@ static void rh_dec(struct region_hash *r
 
 	if (atomic_dec_and_test(&reg->pending)) {
 		spin_lock_irqsave(&rh->region_lock, flags);
+		if (atomic_read(&reg->pending)) { /* check race */
+			spin_unlock_irqrestore(&rh->region_lock, flags);
+			return;
+		}
 		if (reg->state == RH_RECOVERING) {
 			list_add_tail(&reg->list, &rh->quiesced_regions);
 		} else {
--

dm-devel mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/dm-devel

author
#2 lore raw

Hi Jon,

Quoted 3 lines · Jonathan E Brassow

could this be solved by doing your patch in rh_dec and just moving the atomic_inc in rh_inc? The reason I ask is that the mark_region log call can block.

No.
Unless they are serialized, it's possible that rh_inc() will see the state RH_DIRTY, while rh_dec change it to RH_CLEAN.
As a result, the region which has I/O in-flight may be freed.

Is it reasonable to call mark_region() unconditionally? Then we can call it outside of the lock.

Quoted 7 lines
Quoted 7 lines

CPU0 CPU1

-----------------------------------------------------------------------
-------
rh_dec()
if (atomic_dec_and_test(pending))
<the region is still marked dirty>

           if (atomic_read(pending)==0)
Quoted 5 lines
Quoted 5 lines

rh_inc()
atomic_inc(pending) if the region is clean
mark the region dirty and remove from clean list

else do nothing

Quoted 2 lines
Quoted 2 lines

mark the region clean
and move to clean list

author
#3 lore raw

Hello,

I revised the patch based on comments from Jon.
Attached patch should work on the version of mark_region which may block.

Thanks,

Quoted 20 lines · Jun'ichi Nomura
Quoted 3 lines · Jonathan E Brassow

could this be solved by doing your patch in rh_dec and just moving the atomic_inc in rh_inc? The reason I ask is that the mark_region log call can block.

No.
Unless they are serialized, it's possible that rh_inc() will see the state RH_DIRTY, while rh_dec change it to RH_CLEAN.
As a result, the region which has I/O in-flight may be freed.

Is it reasonable to call mark_region() unconditionally? Then we can call it outside of the lock.

Quoted 7 lines
Quoted 7 lines

CPU0 CPU1

-----------------------------------------------------------------------
-------
rh_dec()
if (atomic_dec_and_test(pending))
<the region is still marked dirty>

Quoted 10 lines
           if (atomic_read(pending)==0)
Quoted 5 lines
Quoted 5 lines

rh_inc()
atomic_inc(pending) if the region is clean
mark the region dirty and remove from clean

list
else do nothing

Quoted 2 lines
Quoted 2 lines

mark the region clean
and move to clean list

drivers/md/dm-raid1.c +7 -1
@@ -375,6 +375,9 @@ static void rh_inc(struct region_hash *r
 
 	read_lock(&rh->hash_lock);
 	reg = __rh_find(rh, region);
+	spin_lock_irq(&rh->region_lock);
+	atomic_inc(&reg->pending);
+	spin_unlock_irq(&rh->region_lock);
 	if (reg->state == RH_CLEAN) {
 		rh->log->type->mark_region(rh->log, reg->key);
 

@@ -384,7 +387,6 @@ static void rh_inc(struct region_hash *r
 		spin_unlock_irq(&rh->region_lock);
 	}
 
-	atomic_inc(&reg->pending);
 	read_unlock(&rh->hash_lock);
 }
 

@@ -408,6 +410,10 @@ static void rh_dec(struct region_hash *r
 
 	if (atomic_dec_and_test(&reg->pending)) {
 		spin_lock_irqsave(&rh->region_lock, flags);
+		if (atomic_read(&reg->pending)) { /* check race */
+			spin_unlock_irqrestore(&rh->region_lock, flags);
+			return;
+		}
 		if (reg->state == RH_RECOVERING) {
 			list_add_tail(&reg->list, &rh->quiesced_regions);
 		} else {