From: Neil Brown <neilb@suse.de>
To: "matteo brancaleoni" <mbrancaleoni@gmail.com>
Cc: linux-kernel@vger.kernel.org
Subject: Re: Bio & Biovec-1 increasing cache size, never freed during disk IO
Date: Wed, 1 Mar 2006 10:35:47 +1100 [thread overview]
Message-ID: <17412.56916.247822.749271@cse.unsw.edu.au> (raw)
In-Reply-To: message from matteo brancaleoni on Tuesday February 28
On Tuesday February 28, mbrancaleoni@gmail.com wrote:
> Hi Neil,
>
> seems that the patch that leads to the error is the one signed up by you:
> commit 3795bb0fc52fe2af2749f3ad2185cb9c90871ef8
> Author: NeilBrown <neilb@suse.de>
> Date: Mon Dec 12 02:39:16 2005 -0800
>
> [PATCH] md: fix a use-after-free bug in raid1
>
> Who would submit code with a FIXME like that in it !!!!
>
> Signed-off-by: Neil Brown <neilb@suse.de>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Thanks for finding this.
There are two bugs here.
One is that if BIO_RW_BARRIER is rejected by one drive but not the
other, then we forget to release a bio that we should have released.
The other is that the test for "should we do barrier IO" was wrong so
that even though one device doesn't support it, raid1 keeps trying it
(but only on read-ahead requests....)
It would seem that the devices in your array are not all on the same
controller. Is that correct? There isn't a problem with that, but I
just want to check my understanding of what is happening.
Could you try this patch please and see if it fixes the problem?
Thanks again,
NeilBrown
Signed-off-by: Neil Brown <neilb@suse.de>
### Diffstat output
./drivers/md/raid1.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff ./drivers/md/raid1.c~current~ ./drivers/md/raid1.c
--- ./drivers/md/raid1.c~current~ 2006-02-27 11:52:18.000000000 +1100
+++ ./drivers/md/raid1.c 2006-03-01 10:30:43.000000000 +1100
@@ -375,7 +375,7 @@ static int raid1_end_write_request(struc
/* Don't dec_pending yet, we want to hold
* the reference over the retry
*/
- return 0;
+ goto out;
}
if (test_bit(R1BIO_BehindIO, &r1_bio->state)) {
/* free extra copy of the data pages */
@@ -392,10 +392,11 @@ static int raid1_end_write_request(struc
raid_end_bio_io(r1_bio);
}
+ rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
+ out:
if (r1_bio->bios[mirror]==NULL)
bio_put(bio);
- rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
return 0;
}
@@ -857,7 +858,7 @@ static int make_request(request_queue_t
atomic_set(&r1_bio->remaining, 0);
atomic_set(&r1_bio->behind_remaining, 0);
- do_barriers = bio->bi_rw & BIO_RW_BARRIER;
+ do_barriers = bio_barrier(bio);
if (do_barriers)
set_bit(R1BIO_Barrier, &r1_bio->state);
next prev parent reply other threads:[~2006-02-28 23:36 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-02-25 20:45 Bio & Biovec-1 increasing cache size, never freed during disk IO matteo brancaleoni
2006-02-27 20:38 ` matteo brancaleoni
2006-02-27 22:46 ` Neil Brown
2006-02-28 15:05 ` matteo brancaleoni
2006-02-28 23:35 ` Neil Brown [this message]
2006-03-01 10:46 ` matteo brancaleoni
2006-03-02 6:12 ` Neil Brown
2006-03-02 8:19 ` matteo brancaleoni
2006-03-02 8:58 ` matteo brancaleoni
2006-03-08 21:57 ` Adrian Bunk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=17412.56916.247822.749271@cse.unsw.edu.au \
--to=neilb@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=mbrancaleoni@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).