History

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

Pull ceph fixes from Sage Weil: "These fix several bugs with RBD from 3.11 that didn't get tested in time for the merge window: some error handling, a use-after-free, and a sequencing issue when unmapping and image races with a notify operation. There is also a patch fixing a problem with the new ceph + fscache code that just went in" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: fscache: check consistency does not decrement refcount rbd: fix error handling from rbd_snap_name() rbd: ignore unmapped snapshots that no longer exist rbd: fix use-after free of rbd_dev->disk rbd: make rbd_obj_notify_ack() synchronous rbd: complete notifies before cleaning up osd_client and rbd_dev libceph: add function to ensure notifies are complete

Linus Torvalds committed 13 years ago

Commit e9ff04d2 parents ed24fee 9c89d624 files · +74 −19Browse files

Unified · Split

4 files
  1. drivers/block/rbd.c +59 −18
  2. fs/fscache/cookie.c +2 −1
  3. include/linux/ceph/osd_client.h +2 −0
  4. net/ceph/osd_client.c +11 −0
drivers/block/rbd.c+59−18
@@ -931,12 +931,14 @@ static const char *rbd_dev_v1_snap_name(struct rbd_device *rbd_dev, · 930 unmodified lines
931 u64 snap_id)931 u64 snap_id)
932{932{
933 u32 which;933 u32 which;
934 const char *snap_name;
934 935
935 which = rbd_dev_snap_index(rbd_dev, snap_id);936 which = rbd_dev_snap_index(rbd_dev, snap_id);
936 if (which == BAD_SNAP_INDEX)937 if (which == BAD_SNAP_INDEX)
937 return NULL;938 return ERR_PTR(-ENOENT);
938 939
939 return _rbd_dev_v1_snap_name(rbd_dev, which);940 snap_name = _rbd_dev_v1_snap_name(rbd_dev, which);
941 return snap_name ? snap_name : ERR_PTR(-ENOMEM);
940}942}
941 943
942static const char *rbd_snap_name(struct rbd_device *rbd_dev, u64 snap_id)944static const char *rbd_snap_name(struct rbd_device *rbd_dev, u64 snap_id)
@@ -2812,7 +2814,7 @@ out_err: · 1869 unmodified lines
2812 obj_request_done_set(obj_request);2814 obj_request_done_set(obj_request);
2813}2815}
2814 2816
2815static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id)2817static int rbd_obj_notify_ack_sync(struct rbd_device *rbd_dev, u64 notify_id)
2816{2818{
2817 struct rbd_obj_request *obj_request;2819 struct rbd_obj_request *obj_request;
2818 struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;2820 struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
@@ -2827,16 +2829,17 @@ static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id) · 8 unmodified lines
2827 obj_request->osd_req = rbd_osd_req_create(rbd_dev, false, obj_request);2829 obj_request->osd_req = rbd_osd_req_create(rbd_dev, false, obj_request);
2828 if (!obj_request->osd_req)2830 if (!obj_request->osd_req)
2829 goto out;2831 goto out;
2830 obj_request->callback = rbd_obj_request_put;
2831 2832
2832 osd_req_op_watch_init(obj_request->osd_req, 0, CEPH_OSD_OP_NOTIFY_ACK,2833 osd_req_op_watch_init(obj_request->osd_req, 0, CEPH_OSD_OP_NOTIFY_ACK,
2833 notify_id, 0, 0);2834 notify_id, 0, 0);
2834 rbd_osd_req_format_read(obj_request);2835 rbd_osd_req_format_read(obj_request);
2835 2836
2836 ret = rbd_obj_request_submit(osdc, obj_request);2837 ret = rbd_obj_request_submit(osdc, obj_request);
2837out:
2838 if (ret)2838 if (ret)
2839 rbd_obj_request_put(obj_request);2839 goto out;
2840 ret = rbd_obj_request_wait(obj_request);
2841out:
2842 rbd_obj_request_put(obj_request);
2840 2843
2841 return ret;2844 return ret;
2842}2845}
@@ -2856,7 +2859,7 @@ static void rbd_watch_cb(u64 ver, u64 notify_id, u8 opcode, void *data) · 13 unmodified lines
2856 if (ret)2859 if (ret)
2857 rbd_warn(rbd_dev, "header refresh error (%d)\n", ret);2860 rbd_warn(rbd_dev, "header refresh error (%d)\n", ret);
2858 2861
2859 rbd_obj_notify_ack(rbd_dev, notify_id);2862 rbd_obj_notify_ack_sync(rbd_dev, notify_id);
2860}2863}
2861 2864
2862/*2865/*
@@ -3328,6 +3331,31 @@ static void rbd_exists_validate(struct rbd_device *rbd_dev) · 465 unmodified lines
3328 clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);3331 clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
3329}3332}
3330 3333
3334static void rbd_dev_update_size(struct rbd_device *rbd_dev)
3335{
3336 sector_t size;
3337 bool removing;
3338
3339 /*
3340 * Don't hold the lock while doing disk operations,
3341 * or lock ordering will conflict with the bdev mutex via:
3342 * rbd_add() -> blkdev_get() -> rbd_open()
3343 */
3344 spin_lock_irq(&rbd_dev->lock);
3345 removing = test_bit(RBD_DEV_FLAG_REMOVING, &rbd_dev->flags);
3346 spin_unlock_irq(&rbd_dev->lock);
3347 /*
3348 * If the device is being removed, rbd_dev->disk has
3349 * been destroyed, so don't try to update its size
3350 */
3351 if (!removing) {
3352 size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
3353 dout("setting size to %llu sectors", (unsigned long long)size);
3354 set_capacity(rbd_dev->disk, size);
3355 revalidate_disk(rbd_dev->disk);
3356 }
3357}
3358
3331static int rbd_dev_refresh(struct rbd_device *rbd_dev)3359static int rbd_dev_refresh(struct rbd_device *rbd_dev)
3332{3360{
3333 u64 mapping_size;3361 u64 mapping_size;
@@ -3347,12 +3375,7 @@ static int rbd_dev_refresh(struct rbd_device *rbd_dev) · 13 unmodified lines
3347 up_write(&rbd_dev->header_rwsem);3375 up_write(&rbd_dev->header_rwsem);
3348 3376
3349 if (mapping_size != rbd_dev->mapping.size) {3377 if (mapping_size != rbd_dev->mapping.size) {
3350 sector_t size;3378 rbd_dev_update_size(rbd_dev);
3351
3352 size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
3353 dout("setting size to %llu sectors", (unsigned long long)size);
3354 set_capacity(rbd_dev->disk, size);
3355 revalidate_disk(rbd_dev->disk);
3356 }3379 }
3357 3380
3358 return ret;3381 return ret;
@@ -4061,8 +4084,13 @@ static u64 rbd_v2_snap_id_by_name(struct rbd_device *rbd_dev, const char *name) · 702 unmodified lines
4061 4084
4062 snap_id = snapc->snaps[which];4085 snap_id = snapc->snaps[which];
4063 snap_name = rbd_dev_v2_snap_name(rbd_dev, snap_id);4086 snap_name = rbd_dev_v2_snap_name(rbd_dev, snap_id);
4064 if (IS_ERR(snap_name))4087 if (IS_ERR(snap_name)) {
4065 break;4088 /* ignore no-longer existing snapshots */
4089 if (PTR_ERR(snap_name) == -ENOENT)
4090 continue;
4091 else
4092 break;
4093 }
4066 found = !strcmp(name, snap_name);4094 found = !strcmp(name, snap_name);
4067 kfree(snap_name);4095 kfree(snap_name);
4068 }4096 }
@@ -4141,8 +4169,8 @@ static int rbd_dev_spec_update(struct rbd_device *rbd_dev) · 72 unmodified lines
4141 /* Look up the snapshot name, and make a copy */4169 /* Look up the snapshot name, and make a copy */
4142 4170
4143 snap_name = rbd_snap_name(rbd_dev, spec->snap_id);4171 snap_name = rbd_snap_name(rbd_dev, spec->snap_id);
4144 if (!snap_name) {4172 if (IS_ERR(snap_name)) {
4145 ret = -ENOMEM;4173 ret = PTR_ERR(snap_name);
4146 goto out_err;4174 goto out_err;
4147 }4175 }
4148 4176
@@ -5163,10 +5191,23 @@ static ssize_t rbd_remove(struct bus_type *bus, · 1014 unmodified lines
5163 if (ret < 0 || already)5191 if (ret < 0 || already)
5164 return ret;5192 return ret;
5165 5193
5166 rbd_bus_del_dev(rbd_dev);
5167 ret = rbd_dev_header_watch_sync(rbd_dev, false);5194 ret = rbd_dev_header_watch_sync(rbd_dev, false);
5168 if (ret)5195 if (ret)
5169 rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret);5196 rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret);
5197
5198 /*
5199 * flush remaining watch callbacks - these must be complete
5200 * before the osd_client is shutdown
5201 */
5202 dout("%s: flushing notifies", __func__);
5203 ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc);
5204 /*
5205 * Don't free anything from rbd_dev->disk until after all
5206 * notifies are completely processed. Otherwise
5207 * rbd_bus_del_dev() will race with rbd_watch_cb(), resulting
5208 * in a potential use after free of rbd_dev->disk or rbd_dev.
5209 */
5210 rbd_bus_del_dev(rbd_dev);
5170 rbd_dev_image_release(rbd_dev);5211 rbd_dev_image_release(rbd_dev);
5171 module_put(THIS_MODULE);5212 module_put(THIS_MODULE);
5172 5213
fs/fscache/cookie.c+2−1
@@ -586,7 +586,8 @@ int __fscache_check_consistency(struct fscache_cookie *cookie) · 585 unmodified lines
586 586
587 fscache_operation_init(op, NULL, NULL);587 fscache_operation_init(op, NULL, NULL);
588 op->flags = FSCACHE_OP_MYTHREAD |588 op->flags = FSCACHE_OP_MYTHREAD |
589 (1 << FSCACHE_OP_WAITING);589 (1 << FSCACHE_OP_WAITING) |
590 (1 << FSCACHE_OP_UNUSE_COOKIE);
590 591
591 spin_lock(&cookie->lock);592 spin_lock(&cookie->lock);
592 593
include/linux/ceph/osd_client.h+2−0
@@ -335,6 +335,8 @@ extern int ceph_osdc_wait_request(struct ceph_osd_client *osdc, · 334 unmodified lines
335 struct ceph_osd_request *req);335 struct ceph_osd_request *req);
336extern void ceph_osdc_sync(struct ceph_osd_client *osdc);336extern void ceph_osdc_sync(struct ceph_osd_client *osdc);
337 337
338extern void ceph_osdc_flush_notifies(struct ceph_osd_client *osdc);
339
338extern int ceph_osdc_readpages(struct ceph_osd_client *osdc,340extern int ceph_osdc_readpages(struct ceph_osd_client *osdc,
339 struct ceph_vino vino,341 struct ceph_vino vino,
340 struct ceph_file_layout *layout,342 struct ceph_file_layout *layout,
net/ceph/osd_client.c+11−0
@@ -2215,6 +2215,17 @@ void ceph_osdc_sync(struct ceph_osd_client *osdc) · 2214 unmodified lines
2215}2215}
2216EXPORT_SYMBOL(ceph_osdc_sync);2216EXPORT_SYMBOL(ceph_osdc_sync);
2217 2217
2218/*
2219 * Call all pending notify callbacks - for use after a watch is
2220 * unregistered, to make sure no more callbacks for it will be invoked
2221 */
2222extern void ceph_osdc_flush_notifies(struct ceph_osd_client *osdc)
2223{
2224 flush_workqueue(osdc->notify_wq);
2225}
2226EXPORT_SYMBOL(ceph_osdc_flush_notifies);
2227
2228
2218/*2229/*
2219 * init, shutdown2230 * init, shutdown
2220 */2231 */