summaryrefslogtreecommitdiffstats
path: root/fs/block_dev.c
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.com>2016-12-12 08:21:51 -0700
committerJens Axboe <axboe@fb.com>2016-12-13 21:07:08 -0700
commitbcc7f5b4bee8e327689a4d994022765855c807ff (patch)
tree2e233899a43c69172710876cf626a57139616392 /fs/block_dev.c
parentf4000cd99750065d5177555c0a805c97174d1b9f (diff)
downloadlinux-bcc7f5b4bee8e327689a4d994022765855c807ff.tar.gz
linux-bcc7f5b4bee8e327689a4d994022765855c807ff.tar.bz2
linux-bcc7f5b4bee8e327689a4d994022765855c807ff.zip
block_dev: don't test bdev->bd_contains when it is not stable
bdev->bd_contains is not stable before calling __blkdev_get(). When __blkdev_get() is called on a parition with ->bd_openers == 0 it sets bdev->bd_contains = bdev; which is not correct for a partition. After a call to __blkdev_get() succeeds, ->bd_openers will be > 0 and then ->bd_contains is stable. When FMODE_EXCL is used, blkdev_get() calls bd_start_claiming() -> bd_prepare_to_claim() -> bd_may_claim() This call happens before __blkdev_get() is called, so ->bd_contains is not stable. So bd_may_claim() cannot safely use ->bd_contains. It currently tries to use it, and this can lead to a BUG_ON(). This happens when a whole device is already open with a bd_holder (in use by dm in my particular example) and two threads race to open a partition of that device for the first time, one opening with O_EXCL and one without. The thread that doesn't use O_EXCL gets through blkdev_get() to __blkdev_get(), gains the ->bd_mutex, and sets bdev->bd_contains = bdev; Immediately thereafter the other thread, using FMODE_EXCL, calls bd_start_claiming() from blkdev_get(). This should fail because the whole device has a holder, but because bdev->bd_contains == bdev bd_may_claim() incorrectly reports success. This thread continues and blocks on bd_mutex. The first thread then sets bdev->bd_contains correctly and drops the mutex. The thread using FMODE_EXCL then continues and when it calls bd_may_claim() again in: BUG_ON(!bd_may_claim(bdev, whole, holder)); The BUG_ON fires. Fix this by removing the dependency on ->bd_contains in bd_may_claim(). As bd_may_claim() has direct access to the whole device, it can simply test if the target bdev is the whole device. Fixes: 6b4517a7913a ("block: implement bd_claiming and claiming block") Cc: stable@vger.kernel.org (v2.6.35+) Signed-off-by: NeilBrown <neilb@suse.com> Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'fs/block_dev.c')
-rw-r--r--fs/block_dev.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 95acbd2ebc5d..d4f23353ee4d 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1089,7 +1089,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
return true; /* already a holder */
else if (bdev->bd_holder != NULL)
return false; /* held by someone else */
- else if (bdev->bd_contains == bdev)
+ else if (whole == bdev)
return true; /* is a whole device which isn't held */
else if (whole->bd_holder == bd_may_claim)