Received: by 10.223.185.116 with SMTP id b49csp6368033wrg; Wed, 28 Feb 2018 08:16:01 -0800 (PST) X-Google-Smtp-Source: AH8x225I3g1fzgnEb/MLvp5JhmFgQNAy4rav/te077uGizl/Hv/+nhL5zMh8utVARlpMFuHuT/yy X-Received: by 10.98.102.82 with SMTP id a79mr18285522pfc.138.1519834560962; Wed, 28 Feb 2018 08:16:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519834560; cv=none; d=google.com; s=arc-20160816; b=rrRgx00lPvcxbGo3z0Aj1hGu3+6SPqk2j24jPhnZcYWsFjnvWEqviGVN2HYly8qwwl LivXqTkdXdimvIO5qmXm7CJD9neC5ZLLmkoKyvxeXHQdx979oSlRIn6c5+Rz3XFPLt+8 15aEb3A/W9ks5aVBvxNbzFqNJdR8OVj1chJu9aIzFKxuG/y+9q4ETkNTbAl+/EZp92XT 9sT28pmyR6iAgyq8JA0nmEpv3vnyeyI8+JJOlheEHcetkuCsJEBHQ1Cy9Ki4gdis0dbq abyzj+akfKGl21rzcgjFPM1Yw+yHNzoQ+pgoiduD3JR4/4z1KwZVCDhL7ystukzuKrpq +grg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=WBhEStVelZYrWIXS5wKcaOGrWH7wtSmPATXBK/exQig=; b=gdrFRz2PMsAcEo8W6ffx83qb3pWEedei48CFWWP56Mxoq3QxfKDUOOZGVC4KpoZeKO Or5B0fS3RFdBW+rOVKfox5YCTHx1H92vY7alhloLIJ8dA0jp3AkaPy8p1xuvVGVvNRen mNyPmZbq9GOk9h+TQ7GqOIH7n8aFx912x4tFWrJlfiycyaj1ZfSi3JrYdfjAXb7mpY7o UE7YSU6DHBxTpxHk3YnscybhBeHP33JiAuwQPkAFS78J1Rbj+nF3GCVHcAiHuea2L+mq ShqLPB3YRqjb3eDhMCqXveo2xFBROKOghv7PFO6vKIDLL76VuxI/u0RVj42NL4bNHID3 T3sQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 68si1370271pff.141.2018.02.28.08.15.46; Wed, 28 Feb 2018 08:16:00 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934542AbeB1QOt (ORCPT + 99 others); Wed, 28 Feb 2018 11:14:49 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35124 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934447AbeB1QOo (ORCPT ); Wed, 28 Feb 2018 11:14:44 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Yo-0006XT-CF; Wed, 28 Feb 2018 15:22:26 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yk-0000HE-5v; Wed, 28 Feb 2018 15:22:22 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Monty Pavel" , "Joe Thornber" , "Mike Snitzer" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 215/254] dm btree: fix serious bug in btree_split_beneath() In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Joe Thornber commit bc68d0a43560e950850fc69b58f0f8254b28f6d6 upstream. When inserting a new key/value pair into a btree we walk down the spine of btree nodes performing the following 2 operations: i) space for a new entry ii) adjusting the first key entry if the new key is lower than any in the node. If the _root_ node is full, the function btree_split_beneath() allocates 2 new nodes, and redistibutes the root nodes entries between them. The root node is left with 2 entries corresponding to the 2 new nodes. btree_split_beneath() then adjusts the spine to point to one of the two new children. This means the first key is never adjusted if the new key was lower, ie. operation (ii) gets missed out. This can result in the new key being 'lost' for a period; until another low valued key is inserted that will uncover it. This is a serious bug, and quite hard to make trigger in normal use. A reproducing test case ("thin create devices-in-reverse-order") is available as part of the thin-provision-tools project: https://github.com/jthornber/thin-provisioning-tools/blob/master/functional-tests/device-mapper/dm-tests.scm#L593 Fix the issue by changing btree_split_beneath() so it no longer adjusts the spine. Instead it unlocks both the new nodes, and lets the main loop in btree_insert_raw() relock the appropriate one and make any neccessary adjustments. Reported-by: Monty Pavel Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Ben Hutchings --- drivers/md/persistent-data/dm-btree.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) --- a/drivers/md/persistent-data/dm-btree.c +++ b/drivers/md/persistent-data/dm-btree.c @@ -588,23 +588,8 @@ static int btree_split_beneath(struct sh pn->keys[1] = rn->keys[0]; memcpy_disk(value_ptr(pn, 1), &val, sizeof(__le64)); - /* - * rejig the spine. This is ugly, since it knows too - * much about the spine - */ - if (s->nodes[0] != new_parent) { - unlock_block(s->info, s->nodes[0]); - s->nodes[0] = new_parent; - } - if (key < le64_to_cpu(rn->keys[0])) { - unlock_block(s->info, right); - s->nodes[1] = left; - } else { - unlock_block(s->info, left); - s->nodes[1] = right; - } - s->count = 2; - + unlock_block(s->info, left); + unlock_block(s->info, right); return 0; }