diff options
| author | Joe Thornber <ejt@redhat.com> | 2013-12-13 14:55:55 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-12-20 07:45:11 -0800 |
| commit | 1cfc4552917a128e0cdf15f57abfe60a30f5eaec (patch) | |
| tree | 9b247d08e99c49e3d1a3f87b9f861184a139deff | |
| parent | 20d68d38efd83f2bb598d7b3655a5c230ccc17e8 (diff) | |
| download | linux-3.10-1cfc4552917a128e0cdf15f57abfe60a30f5eaec.tar.gz linux-3.10-1cfc4552917a128e0cdf15f57abfe60a30f5eaec.tar.bz2 linux-3.10-1cfc4552917a128e0cdf15f57abfe60a30f5eaec.zip | |
dm array: fix a reference counting bug in shadow_ablock
commit ed9571f0cf1fe09d3506302610f3ccdfa1d22c4a upstream.
An old array block could have its reference count decremented below
zero when it is being replaced in the btree by a new array block.
The fix is to increment the old ablock's reference count just before
inserting a new ablock into the btree.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/md/persistent-data/dm-array.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c index af96e24ec32..1d75b1dc1e2 100644 --- a/drivers/md/persistent-data/dm-array.c +++ b/drivers/md/persistent-data/dm-array.c @@ -317,8 +317,16 @@ static int shadow_ablock(struct dm_array_info *info, dm_block_t *root, * The shadow op will often be a noop. Only insert if it really * copied data. */ - if (dm_block_location(*block) != b) + if (dm_block_location(*block) != b) { + /* + * dm_tm_shadow_block will have already decremented the old + * block, but it is still referenced by the btree. We + * increment to stop the insert decrementing it below zero + * when overwriting the old value. + */ + dm_tm_inc(info->btree_info.tm, b); r = insert_ablock(info, index, *block, root); + } return r; } |