Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba025082 authored by Tejun Heo's avatar Tejun Heo Committed by Linus Torvalds
Browse files

[PATCH] blk: fix tag shrinking (revive real_max_size) 

My patch in commit fa72b903 incorrectly
removed blk_queue_tag->real_max_depth.

The original resize implementation was incorrect in the following
points.

 * actual allocation size of tag_index was shorter than real_max_size,
   but assumed to be of the same size, possibly causing memory access
   beyond the allocated area.
 * bits in tag_map between max_deptn and real_max_depth were
   initialized to 1's, making the tags permanently reserved.

In an attempt to fix above two bugs, I had removed allocation optimization
in init_tag_map and real_max_size.  Tag map/index were allocated and freed
immediately during resize.

Unfortunately, I wasn't considering that tag map/index can be resized
dynamically with tags beyond new_depth active.  This led to accessing
freed area after shrinking tags and led to the following bug reporting
thread on linux-scsi.

   http://marc.theaimsgroup.com/?l=linux-scsi&m=112319898111885&w=2

To fix the problem, I've revived real_max_depth without allocation
optimization in init_tag_map, and Andrew Vasquez confirmed that the
problem was fixed.  As Jens is not going to be available for a week, he
asked me to make sure that this patch reaches you.

   http://marc.theaimsgroup.com/?l=linux-scsi&m=112325778530886&w=2



Also, a comment was added to make sure that real_max_size is needed for
dynamic shrinking.

Signed-off-by: default avatarTejun Heo <htejun@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent c7546f8f

drivers/block/ll_rw_blk.c

+15 −3
Original line number Diff line number Diff line
@@ -719,7 +719,7 @@ struct request *blk_queue_find_tag(request_queue_t *q, int tag) 
{

	struct blk_queue_tag *bqt = q->queue_tags;



	if (unlikely(bqt == NULL || tag >= bqt->max_depth))

	if (unlikely(bqt == NULL || tag >= bqt->real_max_depth))

		return NULL;



	return bqt->tag_index[tag];
@@ -798,6 +798,7 @@ init_tag_map(request_queue_t *q, struct blk_queue_tag *tags, int depth) 


	memset(tag_index, 0, depth * sizeof(struct request *));

	memset(tag_map, 0, nr_ulongs * sizeof(unsigned long));

	tags->real_max_depth = depth;

	tags->max_depth = depth;

	tags->tag_index = tag_index;

	tags->tag_map = tag_map;
@@ -871,12 +872,23 @@ int blk_queue_resize_tags(request_queue_t *q, int new_depth) 
	if (!bqt)

		return -ENXIO;



	/*

	 * if we already have large enough real_max_depth.  just

	 * adjust max_depth.  *NOTE* as requests with tag value

	 * between new_depth and real_max_depth can be in-flight, tag

	 * map can not be shrunk blindly here.

	 */

	if (new_depth <= bqt->real_max_depth) {

		bqt->max_depth = new_depth;

		return 0;

	}



	/*

	 * save the old state info, so we can copy it back

	 */

	tag_index = bqt->tag_index;

	tag_map = bqt->tag_map;

	max_depth = bqt->max_depth;

	max_depth = bqt->real_max_depth;



	if (init_tag_map(q, bqt, new_depth))

		return -ENOMEM;
@@ -913,7 +925,7 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq) 


	BUG_ON(tag == -1);



	if (unlikely(tag >= bqt->max_depth))

	if (unlikely(tag >= bqt->real_max_depth))

		/*

		 * This can happen after tag depth has been reduced.

		 * FIXME: how about a warning or info message here?

include/linux/blkdev.h

+1 −0
Original line number Diff line number Diff line
@@ -301,6 +301,7 @@ struct blk_queue_tag { 
	struct list_head busy_list;	/* fifo list of busy tags */

	int busy;			/* current depth */

	int max_depth;			/* what we will send to device */

	int real_max_depth;		/* what the array can hold */

	atomic_t refcnt;		/* map can be shared */

};