]>
Commit | Line | Data |
---|---|---|
2cb7cef9 BS |
1 | From: Hannes Reinecke <hare@suse.de> |
2 | Subject: Kernel Oops during path failover | |
3 | References: bnc#458393 | |
4 | ||
5 | I've started a new test run with 10 multipath devices and 100 | |
6 | testcycles (120sec off, 120 sec on). Test failed with an "Oops": | |
7 | ||
8 | Jan 24 00:19:35 z9lp02 kernel: Oops: 0038 [#1] SMP | |
9 | Jan 24 00:19:35 z9lp02 kernel: Modules linked in: iptable_filter ip_tables | |
10 | x_tables dm_round_robin sg sd_mod crc_t10dif zfcp scsi_transport_fc scsi_tgt | |
11 | dm_multipath scsi_dh scsi_mod fuse loop dm_mod qeth_l3 ipv6 qeth qdio ccwgroup | |
12 | chsc_sch dasd_eckd_mod dasd_mod ext3 mbcache jbd | |
13 | Jan 24 00:19:35 z9lp02 kernel: Supported: Yes | |
14 | Jan 24 00:19:35 z9lp02 kernel: CPU: 3 Not tainted 2.6.27.12-2.7-default #1 | |
15 | Jan 24 00:19:35 z9lp02 kernel: Process kblockd/3 (pid: 24, task: | |
16 | 000000007fad6638, ksp: 000000007fadbd38) | |
17 | Jan 24 00:19:35 z9lp02 kernel: Krnl PSW : 0404e00180000000 0000000000192216 | |
18 | (mempool_free+0x2e/0xc4) | |
19 | ||
20 | It looks as if we don't check the 'info' field before accessing it; it | |
21 | might well be NULL if the bio couldn't be initialized. | |
22 | ||
23 | Signed-off-by: Hannes Reinecke <hare@suse.de> | |
24 | ||
25 | Index: linux-2.6.27-SLE11_BRANCH/drivers/md/dm.c | |
26 | =================================================================== | |
27 | --- linux-2.6.27-SLE11_BRANCH.orig/drivers/md/dm.c | |
28 | +++ linux-2.6.27-SLE11_BRANCH/drivers/md/dm.c | |
29 | @@ -714,13 +714,14 @@ static void free_bio_clone(struct reques | |
30 | struct dm_rq_target_io *tio = clone->end_io_data; | |
31 | struct mapped_device *md = tio->md; | |
32 | struct bio *bio; | |
33 | - struct dm_clone_bio_info *info; | |
34 | ||
35 | while ((bio = clone->bio) != NULL) { | |
36 | clone->bio = bio->bi_next; | |
37 | ||
38 | - info = bio->bi_private; | |
39 | - free_bio_info(md, info); | |
40 | + if (bio->bi_private) { | |
41 | + struct dm_clone_bio_info *info = bio->bi_private; | |
42 | + free_bio_info(md, info); | |
43 | + } | |
44 | ||
45 | bio->bi_private = md->bs; | |
46 | bio_put(bio); | |
47 | @@ -1483,6 +1484,7 @@ static int dm_prep_fn(struct request_que | |
48 | tio->orig = rq; | |
49 | tio->error = 0; | |
50 | memset(&tio->info, 0, sizeof(tio->info)); | |
51 | + memset(&tio->clone, 0, sizeof(tio->clone)); | |
52 | ||
53 | clone = &tio->clone; | |
54 | if (setup_clone(clone, rq, tio)) { |