• M
    dm integrity: fix a crash due to BUG_ON in __journal_read_write() · 795b0572
    Mikulas Patocka 提交于
    commit 5729b6e5a1bcb0bbc28abe82d749c7392f66d2c7 upstream.
    
    Fix a crash that was introduced by the commit 724376a0. The crash is
    reported here: https://gitlab.com/cryptsetup/cryptsetup/issues/468
    
    When reading from the integrity device, the function
    dm_integrity_map_continue calls find_journal_node to find out if the
    location to read is present in the journal. Then, it calculates how many
    sectors are consecutively stored in the journal. Then, it locks the range
    with add_new_range and wait_and_add_new_range.
    
    The problem is that during wait_and_add_new_range, we hold no locks (we
    don't hold ic->endio_wait.lock and we don't hold a range lock), so the
    journal may change arbitrarily while wait_and_add_new_range sleeps.
    
    The code then goes to __journal_read_write and hits
    BUG_ON(journal_entry_get_sector(je) != logical_sector); because the
    journal has changed.
    
    In order to fix this bug, we need to re-check the journal location after
    wait_and_add_new_range. We restrict the length to one block in order to
    not complicate the code too much.
    
    Fixes: 724376a0 ("dm integrity: implement fair range locks")
    Cc: stable@vger.kernel.org # v4.19+
    Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: NMike Snitzer <snitzer@redhat.com>
    Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    795b0572
dm-integrity.c 102.3 KB