linux/block
Lukas Czerner 0aeea18964 block: fix mis-synchronisation in blkdev_issue_zeroout()
BZ29402
https://bugzilla.kernel.org/show_bug.cgi?id=29402

We can hit serious mis-synchronization in bio completion path of
blkdev_issue_zeroout() leading to a panic.

The problem is that when we are going to wait_for_completion() in
blkdev_issue_zeroout() we check if the bb.done equals issued (number of
submitted bios). If it does, we can skip the wait_for_completition()
and just out of the function since there is nothing to wait for.
However, there is a ordering problem because bio_batch_end_io() is
calling atomic_inc(&bb->done) before complete(), hence it might seem to
blkdev_issue_zeroout() that all bios has been completed and exit. At
this point when bio_batch_end_io() is going to call complete(bb->wait),
bb and wait does not longer exist since it was allocated on stack in
blkdev_issue_zeroout() ==> panic!

(thread 1)                      (thread 2)
bio_batch_end_io()              blkdev_issue_zeroout()
  if(bb) {                      ...
    if (bb->end_io)             ...
      bb->end_io(bio, err);     ...
    atomic_inc(&bb->done);      ...
    ...                         while (issued != atomic_read(&bb.done))
    ...                         (let issued == bb.done)
    ...                         (do the rest of the function)
    ...                         return ret;
    complete(bb->wait);
    ^^^^^^^^
    panic

We can fix this easily by simplifying bio_batch and completion counting.

Also remove bio_end_io_t *end_io since it is not used.

Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reported-by: Eric Whitney <eric.whitney@hp.com>
Tested-by: Eric Whitney <eric.whitney@hp.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
CC: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2011-03-11 15:36:08 +01:00
..
blk-cgroup.c blk-cgroup: Allow creation of hierarchical cgroups 2010-11-15 19:37:36 +01:00
blk-cgroup.h blkio-throttle: limit max iops value to UINT_MAX 2010-10-01 21:16:41 +02:00
blk-core.c block: add @force_kblockd to __blk_run_queue() 2011-03-02 08:48:05 -05:00
blk-exec.c block: Prevent hang_check firing during long I/O 2010-09-24 15:52:09 +02:00
blk-flush.c block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue() 2011-03-02 08:48:06 -05:00
blk-integrity.c block: Fix double free in blk_integrity_unregister 2010-10-15 15:49:18 +02:00
blk-ioc.c block: Clean up exit_io_context() source code. 2010-12-21 15:07:45 +01:00
blk-iopoll.c tree-wide: fix assorted typos all over the place 2009-12-04 15:39:55 +01:00
blk-lib.c block: fix mis-synchronisation in blkdev_issue_zeroout() 2011-03-11 15:36:08 +01:00
blk-map.c block: check for proper length of iov entries earlier in blk_rq_map_user_iov() 2010-11-29 10:04:50 +01:00
blk-merge.c Merge branch 'for-2.6.38/core' of git://git.kernel.dk/linux-2.6-block 2011-01-13 10:45:01 -08:00
blk-settings.c block: max hardware sectors limit wrapper 2010-12-17 08:36:01 +01:00
blk-softirq.c
blk-sysfs.c block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead 2010-12-17 08:35:53 +01:00
blk-tag.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
blk-throttle.c blk-throttle: Do not use kblockd workqueue for throtl work 2011-03-01 13:41:53 -05:00
blk-timeout.c block: ensure jiffies wrap is handled correctly in blk_rq_timed_out_timer 2010-04-21 17:42:08 +02:00
blk.h Revert "block: fix accounting bug on cross partition merges" 2010-10-24 22:06:02 +02:00
bsg.c [SCSI] bsg: correct fault if queue object removed while dev_t open 2010-12-09 09:41:14 -06:00
cfq-iosched.c block: add @force_kblockd to __blk_run_queue() 2011-03-02 08:48:05 -05:00
cfq.h blk-cgroup: Prepare the base for supporting more than one IO control policies 2010-09-16 08:42:04 +02:00
compat_ioctl.c BKL: remove extraneous #include <smp_lock.h> 2010-11-17 08:59:32 -08:00
deadline-iosched.c
elevator.c block: add @force_kblockd to __blk_run_queue() 2011-03-02 08:48:05 -05:00
genhd.c Fix over-zealous flush_disk when changing device size. 2011-02-24 17:25:47 +11:00
ioctl.c block: fix refcounting in BLKBSZSET 2011-02-24 08:54:21 -08:00
Kconfig kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
Kconfig.iosched blk-cgroup: config options re-arrangement 2010-04-26 19:27:56 +02:00
Makefile Merge branch 'for-2.6.37/barrier' of git://git.kernel.dk/linux-2.6-block 2010-10-22 17:07:18 -07:00
noop-iosched.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
scsi_ioctl.c block: take care not to overflow when calculating total iov length 2010-11-10 14:40:42 +01:00