1. 08 7月, 2014 1 次提交
  2. 23 6月, 2014 1 次提交
    • I
      rbd: handle parent_overlap on writes correctly · 9638556a
      Ilya Dryomov 提交于
      The following check in rbd_img_obj_request_submit()
      
          rbd_dev->parent_overlap <= obj_request->img_offset
      
      allows the fall through to the non-layered write case even if both
      parent_overlap and obj_request->img_offset belong to the same RADOS
      object.  This leads to data corruption, because the area to the left of
      parent_overlap ends up unconditionally zero-filled instead of being
      populated with parent data.  Suppose we want to write 1M to offset 6M
      of image bar, which is a clone of foo@snap; object_size is 4M,
      parent_overlap is 5M:
      
          rbd_data.<id>.0000000000000001
           ---------------------|----------------------|------------
          | should be copyup'ed | should be zeroed out | write ...
           ---------------------|----------------------|------------
         4M                    5M                     6M
                          parent_overlap    obj_request->img_offset
      
      4..5M should be copyup'ed from foo, yet it is zero-filled, just like
      5..6M is.
      
      Given that the only striping mode kernel client currently supports is
      chunking (i.e. stripe_unit == object_size, stripe_count == 1), round
      parent_overlap up to the next object boundary for the purposes of the
      overlap check.
      
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: NIlya Dryomov <ilya.dryomov@inktank.com>
      Reviewed-by: NJosh Durgin <josh.durgin@inktank.com>
      9638556a
  3. 11 6月, 2014 3 次提交
  4. 06 6月, 2014 5 次提交
    • I
      rbd: fix ida/idr memory leak · ffe312cf
      Ilya Dryomov 提交于
      ida_destroy() needs to be called on module exit to release ida caches.
      Signed-off-by: NIlya Dryomov <ilya.dryomov@inktank.com>
      Reviewed-by: NAlex Elder <elder@linaro.org>
      ffe312cf
    • A
      rbd: use reference counts for image requests · 0f2d5be7
      Alex Elder 提交于
      Each image request contains a reference count, but to date it has
      not actually been used.  (I think this was just an oversight.) A
      recent report involving rbd failing an assertion shed light on why
      and where we need to use these reference counts.
      
      Every OSD request associated with an object request uses
      rbd_osd_req_callback() as its callback function.  That function will
      call a helper function (dependent on the type of OSD request) that
      will set the object request's "done" flag if the object request if
      appropriate.  If that "done" flag is set, the object request is
      passed to rbd_obj_request_complete().
      
      In rbd_obj_request_complete(), requests are processed in sequential
      order.  So if an object request completes before one of its
      predecessors in the image request, the completion is deferred.
      Otherwise, if it's a completing object's "turn" to be completed, it
      is passed to rbd_img_obj_end_request(), which records the result of
      the operation, accumulates transferred bytes, and so on.  Next, the
      successor to this request is checked and if it is marked "done",
      (deferred) completion processing is performed on that request, and
      so on.  If the last object request in an image request is completed,
      rbd_img_request_complete() is called, which (typically) destroys
      the image request.
      
      There is a race here, however.  The instant an object request is
      marked "done" it can be provided (by a thread handling completion of
      one of its predecessor operations) to rbd_img_obj_end_request(),
      which (for the last request) can then lead to the image request
      getting torn down.  And this can happen *before* that object has
      itself entered rbd_img_obj_end_request().  As a result, once it
      *does* enter that function, the image request (and even the object
      request itself) may have been freed and become invalid.
      
      All that's necessary to avoid this is to properly count references
      to the image requests.  We tear down an image request's object
      requests all at once--only when the entire image request has
      completed.  So there's no need for an image request to count
      references for its object requests.  However, we don't want an
      image request to go away until the last of its object requests
      has passed through rbd_img_obj_callback().  In other words,
      we don't want rbd_img_request_complete() to necessarily
      result in the image request being destroyed, because it may
      get called before we've finished processing on all of its
      object requests.
      
      So the fix is to add a reference to an image request for
      each of its object requests.  The reference can be viewed
      as representing an object request that has not yet finished
      its call to rbd_img_obj_callback().  That is emphasized by
      getting the reference right after assigning that as the image
      object's callback function.  The corresponding release of that
      reference is done at the end of rbd_img_obj_callback(), which
      every image object request passes through exactly once.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NAlex Elder <elder@linaro.org>
      Reviewed-by: NIlya Dryomov <ilya.dryomov@inktank.com>
      0f2d5be7
    • I
      rbd: fix osd_request memory leak in __rbd_dev_header_watch_sync() · b30a01f2
      Ilya Dryomov 提交于
      osd_request, along with r_request and r_reply messages attached to it
      are leaked in __rbd_dev_header_watch_sync() if the requested image
      doesn't exist.  This is because lingering requests are special and get
      an extra ref in the reply path.  Fix it by unregistering linger request
      on the error path and split __rbd_dev_header_watch_sync() into two
      functions to make it maintainable.
      Signed-off-by: NIlya Dryomov <ilya.dryomov@inktank.com>
      b30a01f2
    • I
      rbd: make sure we have latest osdmap on 'rbd map' · 30ba1f02
      Ilya Dryomov 提交于
      Given an existing idle mapping (img1), mapping an image (img2) in
      a newly created pool (pool2) fails:
      
          $ ceph osd pool create pool1 8 8
          $ rbd create --size 1000 pool1/img1
          $ sudo rbd map pool1/img1
          $ ceph osd pool create pool2 8 8
          $ rbd create --size 1000 pool2/img2
          $ sudo rbd map pool2/img2
          rbd: sysfs write failed
          rbd: map failed: (2) No such file or directory
      
      This is because client instances are shared by default and we don't
      request an osdmap update when bumping a ref on an existing client.  The
      fix is to use the mon_get_version request to see if the osdmap we have
      is the latest, and block until the requested update is received if it's
      not.
      
      Fixes: http://tracker.ceph.com/issues/8184Signed-off-by: NIlya Dryomov <ilya.dryomov@inktank.com>
      Reviewed-by: NSage Weil <sage@inktank.com>
      30ba1f02
    • D
      rbd: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO · 461f758a
      Duan Jiong 提交于
      This patch fixes coccinelle error regarding usage of IS_ERR and
      PTR_ERR instead of PTR_ERR_OR_ZERO.
      Signed-off-by: NDuan Jiong <duanj.fnst@cn.fujitsu.com>
      Reviewed-by: NYan, Zheng <zheng.z.yan@intel.com>
      461f758a
  5. 03 4月, 2014 5 次提交
  6. 30 3月, 2014 1 次提交
    • A
      rbd: drop an unsafe assertion · 638c323c
      Alex Elder 提交于
      Olivier Bonvalet reported having repeated crashes due to a failed
      assertion he was hitting in rbd_img_obj_callback():
      
          Assertion failure in rbd_img_obj_callback() at line 2165:
      	rbd_assert(which >= img_request->next_completion);
      
      With a lot of help from Olivier with reproducing the problem
      we were able to determine the object and image requests had
      already been completed (and often freed) at the point the
      assertion failed.
      
      There was a great deal of discussion on the ceph-devel mailing list
      about this.  The problem only arose when there were two (or more)
      object requests in an image request, and the problem was always
      seen when the second request was being completed.
      
      The problem is due to a race in the window between setting the
      "done" flag on an object request and checking the image request's
      next completion value.  When the first object request completes, it
      checks to see if its successor request is marked "done", and if
      so, that request is also completed.  In the process, the image
      request's next_completion value is updated to reflect that both
      the first and second requests are completed.  By the time the
      second request is able to check the next_completion value, it
      has been set to a value *greater* than its own "which" value,
      which caused an assertion to fail.
      
      Fix this problem by skipping over any completion processing
      unless the completing object request is the next one expected.
      Test only for inequality (not >=), and eliminate the bad
      assertion.
      Tested-by: NOlivier Bonvalet <ob@daevel.fr>
      Signed-off-by: NAlex Elder <elder@linaro.org>
      Reviewed-by: NSage Weil <sage@inktank.com>
      Reviewed-by: NIlya Dryomov <ilya.dryomov@inktank.com>
      638c323c
  7. 28 1月, 2014 4 次提交
  8. 01 1月, 2014 10 次提交
  9. 24 11月, 2013 3 次提交
    • K
      rbd: Refactor bio cloning · 5341a627
      Kent Overstreet 提交于
      Now that we've got drivers converted to the new immutable bvec
      primitives, bio splitting becomes much easier - this is how the new
      bio_split() will work. (Someone more familiar with the ceph code could
      probably use bio_clone_fast() instead of bio_clone() here).
      Signed-off-by: NKent Overstreet <kmo@daterainc.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Yehuda Sadeh <yehuda@inktank.com>
      Cc: Alex Elder <elder@inktank.com>
      Cc: ceph-devel@vger.kernel.org
      5341a627
    • K
      block: Convert bio_for_each_segment() to bvec_iter · 7988613b
      Kent Overstreet 提交于
      More prep work for immutable biovecs - with immutable bvecs drivers
      won't be able to use the biovec directly, they'll need to use helpers
      that take into account bio->bi_iter.bi_bvec_done.
      
      This updates callers for the new usage without changing the
      implementation yet.
      Signed-off-by: NKent Overstreet <kmo@daterainc.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: "Ed L. Cashin" <ecashin@coraid.com>
      Cc: Nick Piggin <npiggin@kernel.dk>
      Cc: Lars Ellenberg <drbd-dev@lists.linbit.com>
      Cc: Jiri Kosina <jkosina@suse.cz>
      Cc: Paul Clements <Paul.Clements@steeleye.com>
      Cc: Jim Paris <jim@jtan.com>
      Cc: Geoff Levand <geoff@infradead.org>
      Cc: Yehuda Sadeh <yehuda@inktank.com>
      Cc: Sage Weil <sage@inktank.com>
      Cc: Alex Elder <elder@inktank.com>
      Cc: ceph-devel@vger.kernel.org
      Cc: Joshua Morris <josh.h.morris@us.ibm.com>
      Cc: Philip Kelleher <pjk1939@linux.vnet.ibm.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: Jeremy Fitzhardinge <jeremy@goop.org>
      Cc: Neil Brown <neilb@suse.de>
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: linux390@de.ibm.com
      Cc: Nagalakshmi Nandigama <Nagalakshmi.Nandigama@lsi.com>
      Cc: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
      Cc: support@lsi.com
      Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Steven Whitehouse <swhiteho@redhat.com>
      Cc: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Guo Chao <yan@linux.vnet.ibm.com>
      Cc: Asai Thambi S P <asamymuthupa@micron.com>
      Cc: Selvan Mani <smani@micron.com>
      Cc: Sam Bradshaw <sbradshaw@micron.com>
      Cc: Matthew Wilcox <matthew.r.wilcox@intel.com>
      Cc: Keith Busch <keith.busch@intel.com>
      Cc: Stephen Hemminger <shemminger@vyatta.com>
      Cc: Quoc-Son Anh <quoc-sonx.anh@intel.com>
      Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>
      Cc: Nitin Gupta <ngupta@vflare.org>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Jerome Marchand <jmarchan@redhat.com>
      Cc: Seth Jennings <sjenning@linux.vnet.ibm.com>
      Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
      Cc: Mike Snitzer <snitzer@redhat.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Cc: "Darrick J. Wong" <darrick.wong@oracle.com>
      Cc: Chris Metcalf <cmetcalf@tilera.com>
      Cc: Jan Kara <jack@suse.cz>
      Cc: linux-m68k@lists.linux-m68k.org
      Cc: linuxppc-dev@lists.ozlabs.org
      Cc: drbd-user@lists.linbit.com
      Cc: nbd-general@lists.sourceforge.net
      Cc: cbe-oss-dev@lists.ozlabs.org
      Cc: xen-devel@lists.xensource.com
      Cc: virtualization@lists.linux-foundation.org
      Cc: linux-raid@vger.kernel.org
      Cc: linux-s390@vger.kernel.org
      Cc: DL-MPTFusionLinux@lsi.com
      Cc: linux-scsi@vger.kernel.org
      Cc: devel@driverdev.osuosl.org
      Cc: linux-fsdevel@vger.kernel.org
      Cc: cluster-devel@redhat.com
      Cc: linux-mm@kvack.org
      Acked-by: NGeoff Levand <geoff@infradead.org>
      7988613b
    • K
      block: Abstract out bvec iterator · 4f024f37
      Kent Overstreet 提交于
      Immutable biovecs are going to require an explicit iterator. To
      implement immutable bvecs, a later patch is going to add a bi_bvec_done
      member to this struct; for now, this patch effectively just renames
      things.
      Signed-off-by: NKent Overstreet <kmo@daterainc.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: "Ed L. Cashin" <ecashin@coraid.com>
      Cc: Nick Piggin <npiggin@kernel.dk>
      Cc: Lars Ellenberg <drbd-dev@lists.linbit.com>
      Cc: Jiri Kosina <jkosina@suse.cz>
      Cc: Matthew Wilcox <willy@linux.intel.com>
      Cc: Geoff Levand <geoff@infradead.org>
      Cc: Yehuda Sadeh <yehuda@inktank.com>
      Cc: Sage Weil <sage@inktank.com>
      Cc: Alex Elder <elder@inktank.com>
      Cc: ceph-devel@vger.kernel.org
      Cc: Joshua Morris <josh.h.morris@us.ibm.com>
      Cc: Philip Kelleher <pjk1939@linux.vnet.ibm.com>
      Cc: Rusty Russell <rusty@rustcorp.com.au>
      Cc: "Michael S. Tsirkin" <mst@redhat.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: Jeremy Fitzhardinge <jeremy@goop.org>
      Cc: Neil Brown <neilb@suse.de>
      Cc: Alasdair Kergon <agk@redhat.com>
      Cc: Mike Snitzer <snitzer@redhat.com>
      Cc: dm-devel@redhat.com
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: linux390@de.ibm.com
      Cc: Boaz Harrosh <bharrosh@panasas.com>
      Cc: Benny Halevy <bhalevy@tonian.com>
      Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: "Nicholas A. Bellinger" <nab@linux-iscsi.org>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Chris Mason <chris.mason@fusionio.com>
      Cc: "Theodore Ts'o" <tytso@mit.edu>
      Cc: Andreas Dilger <adilger.kernel@dilger.ca>
      Cc: Jaegeuk Kim <jaegeuk.kim@samsung.com>
      Cc: Steven Whitehouse <swhiteho@redhat.com>
      Cc: Dave Kleikamp <shaggy@kernel.org>
      Cc: Joern Engel <joern@logfs.org>
      Cc: Prasad Joshi <prasadjoshi.linux@gmail.com>
      Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
      Cc: KONISHI Ryusuke <konishi.ryusuke@lab.ntt.co.jp>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Ben Myers <bpm@sgi.com>
      Cc: xfs@oss.sgi.com
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Frederic Weisbecker <fweisbec@gmail.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Len Brown <len.brown@intel.com>
      Cc: Pavel Machek <pavel@ucw.cz>
      Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
      Cc: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
      Cc: Ben Hutchings <ben@decadent.org.uk>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Guo Chao <yan@linux.vnet.ibm.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Asai Thambi S P <asamymuthupa@micron.com>
      Cc: Selvan Mani <smani@micron.com>
      Cc: Sam Bradshaw <sbradshaw@micron.com>
      Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
      Cc: "Roger Pau Monné" <roger.pau@citrix.com>
      Cc: Jan Beulich <jbeulich@suse.com>
      Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
      Cc: Ian Campbell <Ian.Campbell@citrix.com>
      Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>
      Cc: Christian Borntraeger <borntraeger@de.ibm.com>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Jiang Liu <jiang.liu@huawei.com>
      Cc: Nitin Gupta <ngupta@vflare.org>
      Cc: Jerome Marchand <jmarchand@redhat.com>
      Cc: Joe Perches <joe@perches.com>
      Cc: Peng Tao <tao.peng@emc.com>
      Cc: Andy Adamson <andros@netapp.com>
      Cc: fanchaoting <fanchaoting@cn.fujitsu.com>
      Cc: Jie Liu <jeff.liu@oracle.com>
      Cc: Sunil Mushran <sunil.mushran@gmail.com>
      Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
      Cc: Namjae Jeon <namjae.jeon@samsung.com>
      Cc: Pankaj Kumar <pankaj.km@samsung.com>
      Cc: Dan Magenheimer <dan.magenheimer@oracle.com>
      Cc: Mel Gorman <mgorman@suse.de>6
      4f024f37
  10. 12 9月, 2013 1 次提交
  11. 10 9月, 2013 5 次提交
    • J
      rbd: fix error handling from rbd_snap_name() · da6a6b63
      Josh Durgin 提交于
      rbd_snap_name() calls rbd_dev_v{1,2}_snap_name() depending on the
      format of the image. The format 1 version returns NULL on error, which
      is handled by the caller. The format 2 version returns an ERR_PTR,
      which the caller of rbd_snap_name() does not expect.
      
      Fortunately this is unlikely to occur in practice because
      rbd_snap_id_by_name() is called before rbd_snap_name(). This would hit
      similar errors to rbd_snap_name() (like the snapshot not existing) and
      return early, so rbd_snap_name() would not hit an error unless the
      snapshot was removed between the two calls or memory was exhausted.
      
      Use an ERR_PTR in rbd_dev_v1_snap_name() so that the specific error
      can be propagated, and it is consistent with rbd_dev_v2_snap_name().
      Handle the ERR_PTR in the only rbd_snap_name() caller.
      Suggested-by: NAlex Elder <alex.elder@linaro.org>
      Signed-off-by: NJosh Durgin <josh.durgin@inktank.com>
      Reviewed-by: NAlex Elder <elder@linaro.org>
      da6a6b63
    • J
      rbd: ignore unmapped snapshots that no longer exist · efadc98a
      Josh Durgin 提交于
      This prevents erroring out while adding a device when a snapshot
      unrelated to the current mapping is deleted between reading the
      snapshot context and reading the snapshot names. If the mapped
      snapshot name is not found an error still occurs as usual.
      Signed-off-by: NJosh Durgin <josh.durgin@inktank.com>
      Reviewed-by: NAlex Elder <elder@linaro.org>
      efadc98a
    • J
      rbd: fix use-after free of rbd_dev->disk · 9875201e
      Josh Durgin 提交于
      Removing a device deallocates the disk, unschedules the watch, and
      finally cleans up the rbd_dev structure. rbd_dev_refresh(), called
      from the watch callback, updates the disk size and rbd_dev
      structure. With no locking between them, rbd_dev_refresh() may use the
      device or rbd_dev after they've been freed.
      
      To fix this, check whether RBD_DEV_FLAG_REMOVING is set before
      updating the disk size in rbd_dev_refresh(). In order to prevent a
      race where rbd_dev_refresh() is already revalidating the disk when
      rbd_remove() is called, move the call to rbd_bus_del_dev() after the
      watch is unregistered and all notifies are complete. It's safe to
      defer deleting this structure because no new requests can be submitted
      once the RBD_DEV_FLAG_REMOVING is set, since the device cannot be
      opened.
      
      Fixes: http://tracker.ceph.com/issues/5636Signed-off-by: NJosh Durgin <josh.durgin@inktank.com>
      Reviewed-by: NAlex Elder <elder@linaro.org>
      9875201e
    • J
      rbd: make rbd_obj_notify_ack() synchronous · 20e0af67
      Josh Durgin 提交于
      The only user of rbd_obj_notify_ack() is rbd_watch_cb(). It used
      asynchronously with no tracking of when the notify ack completes, so
      it may still be in progress when the osd_client is shut down.  This
      results in a BUG() since the osd client assumes no requests are in
      flight when it stops. Since all notifies are flushed before the
      osd_client is stopped, waiting for the notify ack to complete before
      returning from the watch callback ensures there are no notify acks in
      flight during shutdown.
      
      Rename rbd_obj_notify_ack() to rbd_obj_notify_ack_sync() to reflect
      its new synchronous nature.
      Signed-off-by: NJosh Durgin <josh.durgin@inktank.com>
      Reviewed-by: NAlex Elder <elder@linaro.org>
      20e0af67
    • J
      rbd: complete notifies before cleaning up osd_client and rbd_dev · 9abc5990
      Josh Durgin 提交于
      To ensure rbd_dev is not used after it's released, flush all pending
      notify callbacks before calling rbd_dev_image_release(). No new
      notifies can be added to the queue at this point because the watch has
      already be unregistered with the osd_client.
      Signed-off-by: NJosh Durgin <josh.durgin@inktank.com>
      Reviewed-by: NAlex Elder <elder@linaro.org>
      9abc5990
  12. 04 9月, 2013 1 次提交