diff options
authorNeilBrown2018-02-15 03:00:15 -0600
committerGreg Kroah-Hartman2018-02-22 08:45:01 -0600
commitbb18512819952a468c8f618fbf0b9a470a854a06 (patch)
parent94abb4921833e70a5d09ac35dbc78e29d67d3d87 (diff)
dm: correctly handle chained bios in dec_pending()
commit 8dd601fa8317243be887458c49f6c29c2f3d719f upstream. dec_pending() is given an error status (possibly 0) to be recorded against a bio. It can be called several times on the one 'struct dm_io', and it is careful to only assign a non-zero error to io->status. However when it then assigned io->status to bio->bi_status, it is not careful and could overwrite a genuine error status with 0. This can happen when chained bios are in use. If a bio is chained beneath the bio that this dm_io is handling, the child bio might complete and set bio->bi_status before the dm_io completes. This has been possible since chained bios were introduced in 3.14, and has become a lot easier to trigger with commit 18a25da84354 ("dm: ensure bio submission follows a depth-first tree walk") as that commit caused dm to start using chained bios itself. A particular failure mode is that if a bio spans an 'error' target and a working target, the 'error' fragment will complete instantly and set the ->bi_status, and the other fragment will normally complete a little later, and will clear ->bi_status. The fix is simply to only assign io_error to bio->bi_status when io_error is not zero. Reported-and-tested-by: Milan Broz <gmazyland@gmail.com> Cc: stable@vger.kernel.org (v3.14+) Signed-off-by: NeilBrown <neilb@suse.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 9ec6948e3b8b..3d9a80759d95 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -974,7 +974,8 @@ static void dec_pending(struct dm_io *io, int error)
974 } else { 974 } else {
975 /* done with normal IO or empty flush */ 975 /* done with normal IO or empty flush */
976 trace_block_bio_complete(md->queue, bio, io_error); 976 trace_block_bio_complete(md->queue, bio, io_error);
977 bio->bi_error = io_error; 977 if (io_error)
978 bio->bi_error = io_error;
978 bio_endio(bio); 979 bio_endio(bio);
979 } 980 }
980 } 981 }