Patch "dm space map metadata: fix occasional leak of a metadata block on resize" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

dm space map metadata: fix occasional leak of a metadata block on resize

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
dm-space-map-metadata-fix-occasional-leak-of-a-metadata-block-on-resize.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Joe Thornber <[email protected]>
Date: Wed, 17 Jun 2015 13:35:19 +0100
Subject: dm space map metadata: fix occasional leak of a metadata block on resize

From: Joe Thornber <[email protected]>

commit 6096d91af0b65a3967139b32d5adbb3647858a26 upstream.

The metadata space map has a simplified 'bootstrap' mode that is operational when extending the space maps. Whilst in this mode it's possible for some refcount decrement operations to become queued (eg, as a result of shadowing one of the bitmap indexes). These decrements were not being applied when switching out of bootstrap mode.

The effect of this bug was the leaking of a 4k metadata block. This is detected by the latest version of thin_check as a non fatal error.

---
 drivers/md/persistent-data/dm-space-map-metadata.c |   50 ++++++++++++++-------
 1 file changed, 35 insertions(+), 15 deletions(-)

@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
 	smm->recursion_count++;
 }
 
+static int apply_bops(struct sm_metadata *smm)
+{
+	int r = 0;
+
+	while (!brb_empty(&smm->uncommitted)) {
+		struct block_op bop;
+
+		r = brb_pop(&smm->uncommitted, &bop);
+		if (r) {
+			DMERR("bug in bop ring buffer");
+			break;
+		}
+
+		r = commit_bop(smm, &bop);
+		if (r)
+			break;
+	}
+
+	return r;
+}
+
 static int out(struct sm_metadata *smm)
 {
 	int r = 0;

@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
 		return -ENOMEM;
 	}
 
-	if (smm->recursion_count == 1) {
-		while (!brb_empty(&smm->uncommitted)) {
-			struct block_op bop;
-
-			r = brb_pop(&smm->uncommitted, &bop);
-			if (r) {
-				DMERR("bug in bop ring buffer");
-				break;
-			}
-
-			r = commit_bop(smm, &bop);
-			if (r)
-				break;
-		}
-	}
+	if (smm->recursion_count == 1)
+		apply_bops(smm);
 
 	smm->recursion_count--;
 

@@ -704,6 +712,12 @@ static int sm_metadata_extend(struct dm_
 		}
 		old_len = smm->begin;
 
+		r = apply_bops(smm);
+		if (r) {
+			DMERR("%s: apply_bops failed", __func__);
+			goto out;
+		}
+
 		r = sm_ll_commit(&smm->ll);
 		if (r)
 			goto out;

@@ -773,6 +787,12 @@ int dm_sm_metadata_create(struct dm_spac
 	if (r)
 		return r;
 
+	r = apply_bops(smm);
+	if (r) {
+		DMERR("%s: apply_bops failed", __func__);
+		return r;
+	}
+
 	return sm_metadata_commit(sm);
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/dm-btree-remove-fix-bug-in-redistribute3.patch queue-4.1/dm-btree-silence-lockdep-lock-inversion-in-dm_btree_del.patch queue-4.1/dm-cache-fix-race-when-issuing-a-policy_replace-operation.patch queue-4.1/dm-thin-allocate-the-cell_sort_array-dynamically.patch queue-4.1/dm-space-map-metadata-fix-occasional-leak-of-a-metadata-block-on-resize.patch