[Devel] [PATCH hci-8.1 1/2] dm-ploop: fix a failed merge failing every later merge on the host

[Denis V. Lunev]

From: Denis V. Lunev <den at openvz.org>

ploop_process_merge_latest_snapshot() collects the status of its fake
merge pios in a function-local static. It is never reset and it is
shared by every ploop device, so once a single pio fails, every later
merge on any device stops after its first pio and returns that old
error, until the module is reloaded. A failure on one device also
aborts a merge running on another.

Keep the status on the stack. The pios carry a pointer to it, so the
function must not return while one of them is outstanding: every exit
already waits for service_pios to drain, and a BUG_ON after the wait
stops the kernel rather than let a late pio write into a dead stack
frame if that ever changes.

Fixes: 6ddad5a4d226 ("dm-ploop: Add ploop target driver")

Signed-off-by: Denis V. Lunev <den at openvz.org>

Feature: dm-ploop: ploop target driver
---
 drivers/md/dm-ploop-cmd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c
index 5fa78e6cff9a..9084ca37f45b 100644
--- a/drivers/md/dm-ploop-cmd.c
+++ b/drivers/md/dm-ploop-cmd.c
@@ -671,7 +671,7 @@ static void service_pio_endio(struct pio *pio, void *data, blk_status_t status)
 
 static int ploop_process_merge_latest_snapshot(struct ploop *ploop)
 {
-	static blk_status_t service_status;
+	blk_status_t service_status = BLK_STS_OK;
 	struct bio_vec bvec = {0};
 	struct pio *pio;
 	int ret = 0;
@@ -711,6 +711,8 @@ static int ploop_process_merge_latest_snapshot(struct ploop *ploop)
 	}
 
 	wait_event(ploop->service_wq, !atomic_read(&ploop->service_pios));
+	/* The pios point at service_status on our stack */
+	BUG_ON(atomic_read(&ploop->service_pios));
 	if (!ret) {
 		spin_lock_irq(&ploop->err_status_lock);
 		ret = blk_status_to_errno(service_status);
-- 
2.53.0