[Devel] [PATCH hci-8.1 v2 1/3] dm-ploop: fix flip_upper_deltas returning with two md_locks held

[Denis V. Lunev]

From: Denis V. Lunev <den at openvz.org>

ploop_check_delta_before_flip() takes the md_lock of a live BAT page
and of the matching page of the lower delta before it compares them.
When it finds a cluster both deltas map, it jumps to unmap past both
unlocks: the cmd returns -EEXIST with the locks held and interrupts
disabled, after freeing the page of the lower delta with its lock still
taken. dmsetup comes back to userspace in atomic context, and the next
pio touching that BAT page spins on its md_lock for good, a hard
lockup.

A flip_upper_deltas message on a chain where the top delta overwrote a
cluster of the lower one gets there. The ploop library does not: its
reverse merge clears those entries in the lower delta with the device
suspended before it flips.

Leave the scan only after both locks are dropped.

Fixes: 0d4b4d0a20a9 ("dm-ploop: introduce per-md page locking")
https://virtuozzo.atlassian.net/browse/VSTOR-153445
Feature: dm-ploop: ploop target driver
Reviewed-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>
Reviewed-by: Konstantin Khorenko <khorenko at virtuozzo.com>
Signed-off-by: Denis V. Lunev <den at openvz.org>
---
 drivers/md/dm-ploop-cmd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c
index 45fa4fe7a45a..d6abbdc3c7e3 100644
--- a/drivers/md/dm-ploop-cmd.c
+++ b/drivers/md/dm-ploop-cmd.c
@@ -1146,11 +1146,13 @@ static int ploop_check_delta_before_flip(struct ploop *ploop, struct file *file)
 			    d_bat_entries[i] != BAT_ENTRY_NONE) {
 				ret = -EEXIST;
 				stop = true;
-				goto unmap;
+				break;
 			}
 		}
 		spin_unlock(&d_md->md_lock);
 		spin_unlock_irq(&md->md_lock);
+		if (stop)
+			break;
 
 		clu = ploop_page_clu_idx_to_bat_clu(md->id, i);
 		if (clu == nr_be - 1) {
-- 
2.53.0