• Lukas Czerner's avatar
    block: fix mis-synchronisation in blkdev_issue_zeroout() · 0aeea189
    Lukas Czerner authored
    BZ29402
    https://bugzilla.kernel.org/show_bug.cgi?id=29402
    
    We can hit serious mis-synchronization in bio completion path of
    blkdev_issue_zeroout() leading to a panic.
    
    The problem is that when we are going to wait_for_completion() in
    blkdev_issue_zeroout() we check if the bb.done equals issued (number of
    submitted bios). If it does, we can skip the wait_for_completition()
    and just out of the function since there is nothing to wait for.
    However, there is a ordering problem because bio_batch_end_io() is
    calling atomic_inc(&bb->done) before complete(), hence it might seem to
    blkdev_issue_zeroout() that all bios has been completed and exit. At
    this point when bio_batch_end_io() is going to call complete(bb->wait),
    bb and wait does not longer exist since it was allocated on stack in
    blkdev_issue_zeroout() ==> panic!
    
    (thread 1)                      (thread 2)
    bio_batch_end_io()              blkdev_issue_zeroout()
      if(bb) {                      ...
        if (bb->end_io)             ...
          bb->end_io(bio, err);     ...
        atomic_inc(&bb->done);      ...
        ...                         while (issued != atomic_read(&bb.done))
        ...                         (let issued == bb.done)
        ...                         (do the rest of the function)
        ...                         return ret;
        complete(bb->wait);
        ^^^^^^^^
        panic
    
    We can fix this easily by simplifying bio_batch and completion counting.
    
    Also remove bio_end_io_t *end_io since it is not used.
    Signed-off-by: default avatarLukas Czerner <lczerner@redhat.com>
    Reported-by: default avatarEric Whitney <eric.whitney@hp.com>
    Tested-by: default avatarEric Whitney <eric.whitney@hp.com>
    Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
    CC: Dmitry Monakhov <dmonakhov@openvz.org>
    Signed-off-by: default avatarJens Axboe <jaxboe@fusionio.com>
    0aeea189
blk-lib.c 4.43 KB