From 512875bd9661368da6f993205a61213b79ba1df0 Mon Sep 17 00:00:00 2001 From: Jun'ichi Nomura Date: Thu, 13 Dec 2007 14:15:25 +0000 Subject: dm: table detect io beyond device This patch fixes a panic on shrinking a DM device if there is outstanding I/O to the part of the device that is being removed. (Normally this doesn't happen - a filesystem would be resized first, for example.) The bug is that __clone_and_map() assumes dm_table_find_target() always returns a valid pointer. It may fail if a bio arrives from the block layer but its target sector is no longer included in the DM btree. This patch appends an empty entry to table->targets[] which will be returned by a lookup beyond the end of the device. After calling dm_table_find_target(), __clone_and_map() and target_message() check for this condition using dm_target_is_valid(). Sample test script to trigger oops: --- drivers/md/dm.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'drivers/md/dm.h') diff --git a/drivers/md/dm.h b/drivers/md/dm.h index 4b3faa45277..177297a88eb 100644 --- a/drivers/md/dm.h +++ b/drivers/md/dm.h @@ -112,6 +112,11 @@ int dm_table_resume_targets(struct dm_table *t); int dm_table_any_congested(struct dm_table *t, int bdi_bits); void dm_table_unplug_all(struct dm_table *t); +/* + * To check the return value from dm_table_find_target(). + */ +#define dm_target_is_valid(t) ((t)->table) + /*----------------------------------------------------------------- * A registry of target types. *---------------------------------------------------------------*/ -- cgit v1.2.3