Commit 2a708cff authored Oct 01, 2015 by Junichi Nomura Committed by Mike Snitzer Oct 01, 2015

dm: fix AB-BA deadlock in __dm_destroy()



__dm_destroy() takes io_barrier SRCU lock (dm_get_live_table) and
suspend_lock in reverse order.  Doing so can cause AB-BA deadlock:

  __dm_destroy                    dm_swap_table
  ---------------------------------------------------
                                  mutex_lock(suspend_lock)
  dm_get_live_table()
    srcu_read_lock(io_barrier)
                                  dm_sync_table()
                                    synchronize_srcu(io_barrier)
                                      .. waiting for dm_put_live_table()
  mutex_lock(suspend_lock)
    .. waiting for suspend_lock

Fix this by taking the locks in proper order.

Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Fixes: ab7c7bb6 ("dm: hold suspend_lock while suspending device during device deletion")
Acked-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org

parent 9ffecb10

drivers/md/dm.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -2837,8 +2837,6 @@ static void __dm_destroy(struct mapped_device *md, bool wait)

		might_sleep();

		map = dm_get_live_table(md, &srcu_idx);

		spin_lock(&_minor_lock);
		idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
		set_bit(DMF_FREEING, &md->flags);
		@@ -2852,14 +2850,14 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
		* do not race with internal suspend.
		*/
		mutex_lock(&md->suspend_lock);
		map = dm_get_live_table(md, &srcu_idx);
		if (!dm_suspended_md(md)) {
		dm_table_presuspend_targets(map);
		dm_table_postsuspend_targets(map);
		}
		mutex_unlock(&md->suspend_lock);

		/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
		dm_put_live_table(md, srcu_idx);
		mutex_unlock(&md->suspend_lock);

		/*
		* Rare, but there may be I/O requests still going to complete,