src/patches/suse-2.6.27.25/patches.suse/dm-mpath-check-info-before-access

   1 From: Hannes Reinecke <hare@suse.de>
   2 Subject: Kernel Oops during path failover
   3 References: bnc#458393
   4
   5 I've started a new test run with 10 multipath devices and 100
   6 testcycles (120sec off, 120 sec on). Test failed with an "Oops":
   7
   8 Jan 24 00:19:35 z9lp02 kernel: Oops: 0038 [#1] SMP
   9 Jan 24 00:19:35 z9lp02 kernel: Modules linked in: iptable_filter ip_tables
  10 x_tables dm_round_robin sg sd_mod crc_t10dif zfcp scsi_transport_fc scsi_tgt
  11 dm_multipath scsi_dh scsi_mod fuse loop dm_mod qeth_l3 ipv6 qeth qdio ccwgroup
  12 chsc_sch dasd_eckd_mod dasd_mod ext3 mbcache jbd
  13 Jan 24 00:19:35 z9lp02 kernel: Supported: Yes
  14 Jan 24 00:19:35 z9lp02 kernel: CPU: 3 Not tainted 2.6.27.12-2.7-default #1
  15 Jan 24 00:19:35 z9lp02 kernel: Process kblockd/3 (pid: 24, task:
  16 000000007fad6638, ksp: 000000007fadbd38)
  17 Jan 24 00:19:35 z9lp02 kernel: Krnl PSW : 0404e00180000000 0000000000192216
  18 (mempool_free+0x2e/0xc4)
  19
  20 It looks as if we don't check the 'info' field before accessing it; it
  21 might well be NULL if the bio couldn't be initialized.
  22
  23 Signed-off-by: Hannes Reinecke <hare@suse.de>
  24
  25 Index: linux-2.6.27-SLE11_BRANCH/drivers/md/dm.c
  26 ===================================================================
  27 --- linux-2.6.27-SLE11_BRANCH.orig/drivers/md/dm.c
  28 +++ linux-2.6.27-SLE11_BRANCH/drivers/md/dm.c
  29 @@ -714,13 +714,14 @@ static void free_bio_clone(struct reques
  30         struct dm_rq_target_io *tio = clone->end_io_data;
  31         struct mapped_device *md = tio->md;
  32         struct bio *bio;
  33 -       struct dm_clone_bio_info *info;
  34
  35         while ((bio = clone->bio) != NULL) {
  36                 clone->bio = bio->bi_next;
  37
  38 -               info = bio->bi_private;
  39 -               free_bio_info(md, info);
  40 +               if (bio->bi_private) {
  41 +                       struct dm_clone_bio_info *info = bio->bi_private;
  42 +                       free_bio_info(md, info);
  43 +               }
  44
  45                 bio->bi_private = md->bs;
  46                 bio_put(bio);
  47 @@ -1483,6 +1484,7 @@ static int dm_prep_fn(struct request_que
  48         tio->orig = rq;
  49         tio->error = 0;
  50         memset(&tio->info, 0, sizeof(tio->info));
  51 +       memset(&tio->clone, 0, sizeof(tio->clone));
  52
  53         clone = &tio->clone;
  54         if (setup_clone(clone, rq, tio)) {