From patchwork Thu Mar 12 11:51:02 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Milan Broz X-Patchwork-Id: 11328 X-Patchwork-Delegate: agk@redhat.com Received: from hormel.redhat.com (hormel1.redhat.com [209.132.177.33]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n2CBp6ix018585 for ; Thu, 12 Mar 2009 11:51:07 GMT Received: from listman.util.phx.redhat.com (listman.util.phx.redhat.com [10.8.4.110]) by hormel.redhat.com (Postfix) with ESMTP id 059BF61837F; Thu, 12 Mar 2009 07:51:06 -0400 (EDT) Received: from int-mx2.corp.redhat.com (nat-pool.util.phx.redhat.com [10.8.5.200]) by listman.util.phx.redhat.com (8.13.1/8.13.1) with ESMTP id n2CBp4Ft031514 for ; Thu, 12 Mar 2009 07:51:05 -0400 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n2CBp4Qa012469 for ; Thu, 12 Mar 2009 07:51:04 -0400 Received: from [10.34.32.183] (mazybook.englab.brq.redhat.com [10.34.32.183]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id n2CBp2SB009988 for ; Thu, 12 Mar 2009 07:51:03 -0400 Message-ID: <49B8F726.8040200@redhat.com> Date: Thu, 12 Mar 2009 12:51:02 +0100 From: Milan Broz User-Agent: Thunderbird 2.0.0.19 (X11/20081209) MIME-Version: 1.0 To: device-mapper development References: <49AFA565.6030902@ahsoftware.de> <49AFBE4A.1010605@redhat.com> <49B0BFBD.7060208@ahsoftware.de> <49B0DDD6.2080608@redhat.com> In-Reply-To: <49B0DDD6.2080608@redhat.com> X-Enigmail-Version: 0.95.7 X-Scanned-By: MIMEDefang 2.58 on 172.16.27.26 X-loop: dm-devel@redhat.com Subject: [dm-devel] [PATCH] dm crypt: wait for possible unfinished endio() call in destructor X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.5 Precedence: junk Reply-To: device-mapper development List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com dm crypt: Wait for possible unfinished endio() call in destructor When user set dm-crypt over loop device and the loop thread processing bios calls bio_endio later than the dm-crypt mapping is destroyed (including mempool for dm io request), the endio can cause this OOPs: (mempool_free from already destroyed mempool). [ 70.381058] EIP is at mempool_free+0x12/0x6b ... [ 70.381058] Process loop0 (pid: 4268, ti=cf3b2000 task=cf1cc1f0 task.ti=cf3b2000) ... [ 70.381058] Call Trace: [ 70.381058] [] ? crypt_dec_pending+0x5e/0x62 [dm_crypt] [ 70.381058] [] ? crypt_endio+0xa2/0xaa [dm_crypt] [ 70.381058] [] ? crypt_endio+0x0/0xaa [dm_crypt] [ 70.381058] [] ? bio_endio+0x2b/0x2e [ 70.381058] [] ? dec_pending+0x224/0x23b [dm_mod] [ 70.381058] [] ? clone_endio+0x79/0xa4 [dm_mod] [ 70.381058] [] ? clone_endio+0x0/0xa4 [dm_mod] [ 70.381058] [] ? bio_endio+0x2b/0x2e [ 70.381058] [] ? loop_thread+0x380/0x3b7 [ 70.381058] [] ? do_lo_send_aops+0x0/0x165 [ 70.381058] [] ? autoremove_wake_function+0x0/0x33 [ 70.381058] [] ? loop_thread+0x0/0x3b7 Fix it by adding reference counter into crypt config and wait till all endio operations finishes. Signed-off-by: Milan Broz --- drivers/md/dm-crypt.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) -- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 35bda49..6cef632 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -95,6 +96,8 @@ struct crypt_config { struct workqueue_struct *io_queue; struct workqueue_struct *crypt_queue; + atomic_t pending; + /* * crypto related data */ @@ -566,6 +569,7 @@ static void crypt_dec_pending(struct dm_crypt_io *io) } mempool_free(io, cc->io_pool); + atomic_dec(&cc->pending); } /* @@ -1113,6 +1117,8 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) goto bad_crypt_queue; } + atomic_set(&cc->pending, 0); + ti->private = cc; return 0; @@ -1149,6 +1155,9 @@ static void crypt_dtr(struct dm_target *ti) destroy_workqueue(cc->io_queue); destroy_workqueue(cc->crypt_queue); + while (atomic_read(&cc->pending)) + msleep(1); + if (cc->req) mempool_free(cc->req, cc->req_pool); @@ -1171,8 +1180,11 @@ static void crypt_dtr(struct dm_target *ti) static int crypt_map(struct dm_target *ti, struct bio *bio, union map_info *map_context) { + struct crypt_config *cc = ti->private; struct dm_crypt_io *io; + atomic_inc(&cc->pending); + io = crypt_io_alloc(ti, bio, bio->bi_sector - ti->begin); if (bio_data_dir(io->base_bio) == READ)