• Shiva Krishna Merla's avatar
    dm mpath: fix race condition between multipath_dtr and pg_init_done · 954a73d5
    Shiva Krishna Merla authored
    Whenever multipath_dtr() is happening we must prevent queueing any
    further path activation work.  Implement this by adding a new
    'pg_init_disabled' flag to the multipath structure that denotes future
    path activation work should be skipped if it is set.  By disabling
    pg_init and then re-enabling in flush_multipath_work() we also avoid the
    potential for pg_init to be initiated while suspending an mpath device.
    
    Without this patch a race condition exists that may result in a kernel
    panic:
    
    1) If after pg_init_done() decrements pg_init_in_progress to 0, a call
       to wait_for_pg_init_completion() assumes there are no more pending path
       management commands.
    2) If pg_init_required is set by pg_init_done(), due to retryable
       mode_select errors, then process_queued_ios() will again queue the
       path activation work.
    3) If free_multipath() completes before activate_path() work is called a
       NULL pointer dereference like the following can be seen when
       accessing members of the recently destructed multipath:
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000090
    RIP: 0010:[<ffffffffa003db1b>]  [<ffffffffa003db1b>] activate_path+0x1b/0x30 [dm_multipath]
    [<ffffffff81090ac0>] worker_thread+0x170/0x2a0
    [<ffffffff81096c80>] ? autoremove_wake_function+0x0/0x40
    
    [switch to disabling pg_init in flush_multipath_work & header edits by Mike Snitzer]
    Signed-off-by: default avatarShiva Krishna Merla <shivakrishna.merla@netapp.com>
    Reviewed-by: default avatarKrishnasamy Somasundaram <somasundaram.krishnasamy@netapp.com>
    Tested-by: default avatarSpeagle Andy <Andy.Speagle@netapp.com>
    Acked-by: default avatarJunichi Nomura <j-nomura@ce.jp.nec.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    Cc: stable@vger.kernel.org
    954a73d5
dm-mpath.c 41.6 KB