Commit 8e62b0c3 authored by Mike Snitzer's avatar Mike Snitzer Committed by Yongqiang Liu
Browse files

dm: interlock pending dm_io and dm_wait_for_bios_completion 

stable inclusion
from stable-4.19.242
commit b18fdfb00838594b669749e8f2f622c5df1e43ad
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5A6BA


CVE: NA

--------------------------------

commit 9f6dc633 upstream.

Commit d208b894 ("dm: fix mempool NULL pointer race when
completing IO") didn't go far enough.

When bio_end_io_acct ends the count of in-flight I/Os may reach zero
and the DM device may be suspended. There is a possibility that the
suspend races with dm_stats_account_io.

Fix this by adding percpu "pending_io" counters to track outstanding
dm_io. Move kicking of suspend queue to dm_io_dec_pending(). Also,
rename md_in_flight_bios() to dm_in_flight_bios() and update it to
iterate all pending_io counters.

Fixes: d208b894 ("dm: fix mempool NULL pointer race when completing IO")
Cc: stable@vger.kernel.org
Co-developed-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Reviewed-by: default avatarMike Snitzer <snitzer@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 1cc4f2e3

drivers/md/dm.c

+2 −0
Original line number Diff line number Diff line
@@ -2481,6 +2481,8 @@ static int dm_wait_for_completion(struct mapped_device *md, long task_state) 
	}

	finish_wait(&md->wait, &wait);



	smp_rmb(); /* paired with atomic_dec_return in end_io_acct */



	return r;

}