dm snapshot: avoid having two exceptions for the same chunk

We need to check if the exception was completed after dropping the lock.

After regaining the lock, __find_pending_exception checks if the exception
was already placed into &s->pending hash.

But we don't check if the exception was already completed and placed into
&s->complete hash. If the process waiting in alloc_pending_exception was
delayed at this point because of a scheduling latency and the exception
was meanwhile completed, we'd miss that and allocate another pending
exception for already completed chunk.

It would lead to a situation where two records for the same chunk exist
and potential data corruption because multiple snapshot I/Os to the
affected chunk could be redirected to different locations in the
snapshot.

Cc: stable@kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index eb7291a842035da11f12ee9b460260c198b40959..462750c66319a51edb0af2c3ae2c460f2a527b15 100644 (file)
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -1080,6 +1080,13 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
                                goto out_unlock;
                        }
 
+                       e = lookup_exception(&s->complete, chunk);
+                       if (e) {
+                               free_pending_exception(pe);
+                               remap_exception(s, e, bio, chunk);
+                               goto out_unlock;
+                       }
+
                        pe = __find_pending_exception(s, pe, chunk);
                        if (!pe) {
                                __invalidate_snapshot(s, -ENOMEM);
@@ -1226,6 +1233,12 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
                                goto next_snapshot;
                        }
 
+                       e = lookup_exception(&snap->complete, chunk);
+                       if (e) {
+                               free_pending_exception(pe);
+                               goto next_snapshot;
+                       }
+
                        pe = __find_pending_exception(snap, pe, chunk);
                        if (!pe) {
                                __invalidate_snapshot(snap, -ENOMEM);