Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed9571f0 authored by Joe Thornber's avatar Joe Thornber Committed by Mike Snitzer
Browse files

dm array: fix a reference counting bug in shadow_ablock 



An old array block could have its reference count decremented below
zero when it is being replaced in the btree by a new array block.

The fix is to increment the old ablock's reference count just before
inserting a new ablock into the btree.

Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 3.9+
parent 5b564d80

drivers/md/persistent-data/dm-array.c

+9 −1
Original line number Diff line number Diff line
@@ -317,8 +317,16 @@ static int shadow_ablock(struct dm_array_info *info, dm_block_t *root, 
	 * The shadow op will often be a noop.  Only insert if it really

	 * copied data.

	 */

	if (dm_block_location(*block) != b)

	if (dm_block_location(*block) != b) {

		/*

		 * dm_tm_shadow_block will have already decremented the old

		 * block, but it is still referenced by the btree.  We

		 * increment to stop the insert decrementing it below zero

		 * when overwriting the old value.

		 */

		dm_tm_inc(info->btree_info.tm, b);

		r = insert_ablock(info, index, *block, root);

	}



	return r;

}