History

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

Pull ceph fixes from Sage Weil: "These fix several bugs with RBD from 3.11 that didn't get tested in time for the merge window: some error handling, a use-after-free, and a sequencing issue when unmapping and image races with a notify operation. There is also a patch fixing a problem with the new ceph + fscache code that just went in" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: fscache: check consistency does not decrement refcount rbd: fix error handling from rbd_snap_name() rbd: ignore unmapped snapshots that no longer exist rbd: fix use-after free of rbd_dev->disk rbd: make rbd_obj_notify_ack() synchronous rbd: complete notifies before cleaning up osd_client and rbd_dev libceph: add function to ensure notifies are complete

Linus Torvalds committed 13 years ago

Commit e9ff04d2 parents ed24fee 9c89d624 files · +74 −19Browse files

Unified · Split

4 files
  1. drivers/block/rbd.c +59 −18
  2. fs/fscache/cookie.c +2 −1
  3. include/linux/ceph/osd_client.h +2 −0
  4. net/ceph/osd_client.c +11 −0
drivers/block/rbd.c+59−18
@@ -931,12 +931,14 @@ static const char *rbd_dev_v1_snap_name(struct rbd_device *rbd_dev, · 930 unmodified lines
931931 u64 snap_id)
932932 {
933933 u32 which;
934+ const char *snap_name;
934935
935936 which = rbd_dev_snap_index(rbd_dev, snap_id);
936937 if (which == BAD_SNAP_INDEX)
937− return NULL;
938+ return ERR_PTR(-ENOENT);
938939
939− return _rbd_dev_v1_snap_name(rbd_dev, which);
940+ snap_name = _rbd_dev_v1_snap_name(rbd_dev, which);
941+ return snap_name ? snap_name : ERR_PTR(-ENOMEM);
940942 }
941943
942944 static const char *rbd_snap_name(struct rbd_device *rbd_dev, u64 snap_id)
@@ -2812,7 +2814,7 @@ out_err: · 1869 unmodified lines
28122814 obj_request_done_set(obj_request);
28132815 }
28142816
2815−static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id)
2817+static int rbd_obj_notify_ack_sync(struct rbd_device *rbd_dev, u64 notify_id)
28162818 {
28172819 struct rbd_obj_request *obj_request;
28182820 struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
@@ -2827,16 +2829,17 @@ static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id) · 8 unmodified lines
28272829 obj_request->osd_req = rbd_osd_req_create(rbd_dev, false, obj_request);
28282830 if (!obj_request->osd_req)
28292831 goto out;
2830− obj_request->callback = rbd_obj_request_put;
28312832
28322833 osd_req_op_watch_init(obj_request->osd_req, 0, CEPH_OSD_OP_NOTIFY_ACK,
28332834 notify_id, 0, 0);
28342835 rbd_osd_req_format_read(obj_request);
28352836
28362837 ret = rbd_obj_request_submit(osdc, obj_request);
2837−out:
28382838 if (ret)
2839− rbd_obj_request_put(obj_request);
2839+ goto out;
2840+ ret = rbd_obj_request_wait(obj_request);
2841+out:
2842+ rbd_obj_request_put(obj_request);
28402843
28412844 return ret;
28422845 }
@@ -2856,7 +2859,7 @@ static void rbd_watch_cb(u64 ver, u64 notify_id, u8 opcode, void *data) · 13 unmodified lines
28562859 if (ret)
28572860 rbd_warn(rbd_dev, "header refresh error (%d)\n", ret);
28582861
2859− rbd_obj_notify_ack(rbd_dev, notify_id);
2862+ rbd_obj_notify_ack_sync(rbd_dev, notify_id);
28602863 }
28612864
28622865 /*
@@ -3328,6 +3331,31 @@ static void rbd_exists_validate(struct rbd_device *rbd_dev) · 465 unmodified lines
33283331 clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
33293332 }
33303333
3334+static void rbd_dev_update_size(struct rbd_device *rbd_dev)
3335+{
3336+ sector_t size;
3337+ bool removing;
3338+
3339+ /*
3340+ * Don't hold the lock while doing disk operations,
3341+ * or lock ordering will conflict with the bdev mutex via:
3342+ * rbd_add() -> blkdev_get() -> rbd_open()
3343+ */
3344+ spin_lock_irq(&rbd_dev->lock);
3345+ removing = test_bit(RBD_DEV_FLAG_REMOVING, &rbd_dev->flags);
3346+ spin_unlock_irq(&rbd_dev->lock);
3347+ /*
3348+ * If the device is being removed, rbd_dev->disk has
3349+ * been destroyed, so don't try to update its size
3350+ */
3351+ if (!removing) {
3352+ size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
3353+ dout("setting size to %llu sectors", (unsigned long long)size);
3354+ set_capacity(rbd_dev->disk, size);
3355+ revalidate_disk(rbd_dev->disk);
3356+ }
3357+}
3358+
33313359 static int rbd_dev_refresh(struct rbd_device *rbd_dev)
33323360 {
33333361 u64 mapping_size;
@@ -3347,12 +3375,7 @@ static int rbd_dev_refresh(struct rbd_device *rbd_dev) · 13 unmodified lines
33473375 up_write(&rbd_dev->header_rwsem);
33483376
33493377 if (mapping_size != rbd_dev->mapping.size) {
3350− sector_t size;
3351−
3352− size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
3353− dout("setting size to %llu sectors", (unsigned long long)size);
3354− set_capacity(rbd_dev->disk, size);
3355− revalidate_disk(rbd_dev->disk);
3378+ rbd_dev_update_size(rbd_dev);
33563379 }
33573380
33583381 return ret;
@@ -4061,8 +4084,13 @@ static u64 rbd_v2_snap_id_by_name(struct rbd_device *rbd_dev, const char *name) · 702 unmodified lines
40614084
40624085 snap_id = snapc->snaps[which];
40634086 snap_name = rbd_dev_v2_snap_name(rbd_dev, snap_id);
4064− if (IS_ERR(snap_name))
4065− break;
4087+ if (IS_ERR(snap_name)) {
4088+ /* ignore no-longer existing snapshots */
4089+ if (PTR_ERR(snap_name) == -ENOENT)
4090+ continue;
4091+ else
4092+ break;
4093+ }
40664094 found = !strcmp(name, snap_name);
40674095 kfree(snap_name);
40684096 }
@@ -4141,8 +4169,8 @@ static int rbd_dev_spec_update(struct rbd_device *rbd_dev) · 72 unmodified lines
41414169 /* Look up the snapshot name, and make a copy */
41424170
41434171 snap_name = rbd_snap_name(rbd_dev, spec->snap_id);
4144− if (!snap_name) {
4145− ret = -ENOMEM;
4172+ if (IS_ERR(snap_name)) {
4173+ ret = PTR_ERR(snap_name);
41464174 goto out_err;
41474175 }
41484176
@@ -5163,10 +5191,23 @@ static ssize_t rbd_remove(struct bus_type *bus, · 1014 unmodified lines
51635191 if (ret < 0 || already)
51645192 return ret;
51655193
5166− rbd_bus_del_dev(rbd_dev);
51675194 ret = rbd_dev_header_watch_sync(rbd_dev, false);
51685195 if (ret)
51695196 rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret);
5197+
5198+ /*
5199+ * flush remaining watch callbacks - these must be complete
5200+ * before the osd_client is shutdown
5201+ */
5202+ dout("%s: flushing notifies", __func__);
5203+ ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc);
5204+ /*
5205+ * Don't free anything from rbd_dev->disk until after all
5206+ * notifies are completely processed. Otherwise
5207+ * rbd_bus_del_dev() will race with rbd_watch_cb(), resulting
5208+ * in a potential use after free of rbd_dev->disk or rbd_dev.
5209+ */
5210+ rbd_bus_del_dev(rbd_dev);
51705211 rbd_dev_image_release(rbd_dev);
51715212 module_put(THIS_MODULE);
51725213
fs/fscache/cookie.c+2−1
@@ -586,7 +586,8 @@ int __fscache_check_consistency(struct fscache_cookie *cookie) · 585 unmodified lines
586586
587587 fscache_operation_init(op, NULL, NULL);
588588 op->flags = FSCACHE_OP_MYTHREAD |
589− (1 << FSCACHE_OP_WAITING);
589+ (1 << FSCACHE_OP_WAITING) |
590+ (1 << FSCACHE_OP_UNUSE_COOKIE);
590591
591592 spin_lock(&cookie->lock);
592593
include/linux/ceph/osd_client.h+2−0
@@ -335,6 +335,8 @@ extern int ceph_osdc_wait_request(struct ceph_osd_client *osdc, · 334 unmodified lines
335335 struct ceph_osd_request *req);
336336 extern void ceph_osdc_sync(struct ceph_osd_client *osdc);
337337
338+extern void ceph_osdc_flush_notifies(struct ceph_osd_client *osdc);
339+
338340 extern int ceph_osdc_readpages(struct ceph_osd_client *osdc,
339341 struct ceph_vino vino,
340342 struct ceph_file_layout *layout,
net/ceph/osd_client.c+11−0
@@ -2215,6 +2215,17 @@ void ceph_osdc_sync(struct ceph_osd_client *osdc) · 2214 unmodified lines
22152215 }
22162216 EXPORT_SYMBOL(ceph_osdc_sync);
22172217
2218+/*
2219+ * Call all pending notify callbacks - for use after a watch is
2220+ * unregistered, to make sure no more callbacks for it will be invoked
2221+ */
2222+extern void ceph_osdc_flush_notifies(struct ceph_osd_client *osdc)
2223+{
2224+ flush_workqueue(osdc->notify_wq);
2225+}
2226+EXPORT_SYMBOL(ceph_osdc_flush_notifies);
2227+
2228+
22182229 /*
22192230 * init, shutdown
22202231 */