Merge tag 'dm-4.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fixes from Mike Snitzer:
 "Five stable fixes:

   - Two DM btree bufio buffer leak fixes that resolve reported BUG_ONs
     during DM thinp metadata close's dm_bufio_client_destroy().

   - A DM thinp range discard fix to handle discarding a partially
     mapped range.

   - A DM thinp metadata snapshot fix to make sure the btree roots saved
     in the metadata snapshot are the most current.

   - A DM space map metadata refcounting fix that improves both DM thinp
     and DM cache metadata"

* tag 'dm-4.4-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm btree: fix bufio buffer leaks in dm_btree_del() error path
  dm space map metadata: fix ref counting bug when bootstrapping a new space map
  dm thin metadata: fix bug when taking a metadata snapshot
  dm thin metadata: fix bug in dm_thin_remove_range()
  dm btree: fix leak of bufio-backed block in btree_split_sibling error path

4 files changed, 161 insertions, 20 deletions

diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 1fa45695b68a..c219a053c7f6 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1207,6 +1207,12 @@ static int __reserve_metadata_snap(struct dm_pool_metadata *pmd)
         dm_block_t held_root;
 
         /*
+         * We commit to ensure the btree roots which we increment in a
+         * moment are up to date.
+         */
+        __commit_transaction(pmd);
+
+        /*
          * Copy the superblock.
          */
         dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
@@ -1538,7 +1544,7 @@ static int __remove(struct dm_thin_device *td, dm_block_t block)
 static int __remove_range(struct dm_thin_device *td, dm_block_t begin, dm_block_t end)
 {
         int r;
-        unsigned count;
+        unsigned count, total_count = 0;
         struct dm_pool_metadata *pmd = td->pmd;
         dm_block_t keys[1] = { td->id };
         __le64 value;
@@ -1561,11 +1567,29 @@ static int __remove_range(struct dm_thin_device *td, dm_block_t begin, dm_block_
         if (r)
                 return r;
 
-        r = dm_btree_remove_leaves(&pmd->bl_info, mapping_root, &begin, end, &mapping_root, &count);
-        if (r)
-                return r;
+        /*
+         * Remove leaves stops at the first unmapped entry, so we have to
+         * loop round finding mapped ranges.
+         */
+        while (begin < end) {
+                r = dm_btree_lookup_next(&pmd->bl_info, mapping_root, &begin, &begin, &value);
+                if (r == -ENODATA)
+                        break;
+
+                if (r)
+                        return r;
+
+                if (begin >= end)
+                        break;
+
+                r = dm_btree_remove_leaves(&pmd->bl_info, mapping_root, &begin, end, &mapping_root, &count);
+                if (r)
+                        return r;
+
+                total_count += count;
+        }
 
-        td->mapped_blocks -= count;
+        td->mapped_blocks -= total_count;
         td->changed = 1;
 
         /*
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index c573402033b2..b1ced58eb5e1 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -63,6 +63,11 @@ int lower_bound(struct btree_node *n, uint64_t key)
         return bsearch(n, key, 0);
 }
 
+static int upper_bound(struct btree_node *n, uint64_t key)
+{
+        return bsearch(n, key, 1);
+}
+
 void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
                   struct dm_btree_value_type *vt)
 {
@@ -252,6 +257,16 @@ static void pop_frame(struct del_stack *s)
         dm_tm_unlock(s->tm, f->b);
 }
 
+static void unlock_all_frames(struct del_stack *s)
+{
+        struct frame *f;
+
+        while (unprocessed_frames(s)) {
+                f = s->spine + s->top--;
+                dm_tm_unlock(s->tm, f->b);
+        }
+}
+
 int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
 {
         int r;
@@ -308,9 +323,13 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
                         pop_frame(s);
                 }
         }
-
 out:
+        if (r) {
+                /* cleanup all frames of del_stack */
+                unlock_all_frames(s);
+        }
         kfree(s);
+
         return r;
 }
 EXPORT_SYMBOL_GPL(dm_btree_del);
@@ -392,6 +411,82 @@ int dm_btree_lookup(struct dm_btree_info *info, dm_block_t root,
 }
 EXPORT_SYMBOL_GPL(dm_btree_lookup);
 
+static int dm_btree_lookup_next_single(struct dm_btree_info *info, dm_block_t root,
+                                       uint64_t key, uint64_t *rkey, void *value_le)
+{
+        int r, i;
+        uint32_t flags, nr_entries;
+        struct dm_block *node;
+        struct btree_node *n;
+
+        r = bn_read_lock(info, root, &node);
+        if (r)
+                return r;
+
+        n = dm_block_data(node);
+        flags = le32_to_cpu(n->header.flags);
+        nr_entries = le32_to_cpu(n->header.nr_entries);
+
+        if (flags & INTERNAL_NODE) {
+                i = lower_bound(n, key);
+                if (i < 0 || i >= nr_entries) {
+                        r = -ENODATA;
+                        goto out;
+                }
+
+                r = dm_btree_lookup_next_single(info, value64(n, i), key, rkey, value_le);
+                if (r == -ENODATA && i < (nr_entries - 1)) {
+                        i++;
+                        r = dm_btree_lookup_next_single(info, value64(n, i), key, rkey, value_le);
+                }
+
+        } else {
+                i = upper_bound(n, key);
+                if (i < 0 || i >= nr_entries) {
+                        r = -ENODATA;
+                        goto out;
+                }
+
+                *rkey = le64_to_cpu(n->keys[i]);
+                memcpy(value_le, value_ptr(n, i), info->value_type.size);
+        }
+out:
+        dm_tm_unlock(info->tm, node);
+        return r;
+}
+
+int dm_btree_lookup_next(struct dm_btree_info *info, dm_block_t root,
+                         uint64_t *keys, uint64_t *rkey, void *value_le)
+{
+        unsigned level;
+        int r = -ENODATA;
+        __le64 internal_value_le;
+        struct ro_spine spine;
+
+        init_ro_spine(&spine, info);
+        for (level = 0; level < info->levels - 1u; level++) {
+                r = btree_lookup_raw(&spine, root, keys[level],
+                                     lower_bound, rkey,
+                                     &internal_value_le, sizeof(uint64_t));
+                if (r)
+                        goto out;
+
+                if (*rkey != keys[level]) {
+                        r = -ENODATA;
+                        goto out;
+                }
+
+                root = le64_to_cpu(internal_value_le);
+        }
+
+        r = dm_btree_lookup_next_single(info, root, keys[level], rkey, value_le);
+out:
+        exit_ro_spine(&spine);
+        return r;
+}
+
+EXPORT_SYMBOL_GPL(dm_btree_lookup_next);
+
 /*
  * Splits a node by creating a sibling node and shifting half the nodes
  * contents across.  Assumes there is a parent node, and it has room for
@@ -473,8 +568,10 @@ static int btree_split_sibling(struct shadow_spine *s, unsigned parent_index,
 
         r = insert_at(sizeof(__le64), pn, parent_index + 1,
                       le64_to_cpu(rn->keys[0]), &location);
-        if (r)
+        if (r) {
+                unlock_block(s->info, right);
                 return r;
+        }
 
         if (key < le64_to_cpu(rn->keys[0])) {
                 unlock_block(s->info, right);
diff --git a/drivers/md/persistent-data/dm-btree.h b/drivers/md/persistent-data/dm-btree.h
index 11d8cf78621d..c74301fa5a37 100644
--- a/drivers/md/persistent-data/dm-btree.h
+++ b/drivers/md/persistent-data/dm-btree.h
@@ -110,6 +110,13 @@ int dm_btree_lookup(struct dm_btree_info *info, dm_block_t root,
                     uint64_t *keys, void *value_le);
 
 /*
+ * Tries to find the first key where the bottom level key is >= to that
+ * given.  Useful for skipping empty sections of the btree.
+ */
+int dm_btree_lookup_next(struct dm_btree_info *info, dm_block_t root,
+                         uint64_t *keys, uint64_t *rkey, void *value_le);
+
+/*
  * Insertion (or overwrite an existing value).  O(ln(n))
  */
 int dm_btree_insert(struct dm_btree_info *info, dm_block_t root,
@@ -135,9 +142,10 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
                     uint64_t *keys, dm_block_t *new_root);
 
 /*
- * Removes values between 'keys' and keys2, where keys2 is keys with the
- * final key replaced with 'end_key'.  'end_key' is the one-past-the-end
- * value.  'keys' may be altered.
+ * Removes a _contiguous_ run of values starting from 'keys' and not
+ * reaching keys2 (where keys2 is keys with the final key replaced with
+ * 'end_key').  'end_key' is the one-past-the-end value.  'keys' may be
+ * altered.
  */
 int dm_btree_remove_leaves(struct dm_btree_info *info, dm_block_t root,
                            uint64_t *keys, uint64_t end_key,
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 53091295fce9..fca6dbcf9a47 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -136,7 +136,7 @@ static int brb_push(struct bop_ring_buffer *brb,
         return 0;
 }
 
-static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+static int brb_peek(struct bop_ring_buffer *brb, struct block_op *result)
 {
         struct block_op *bop;
 
@@ -147,6 +147,17 @@ static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
         result->type = bop->type;
         result->block = bop->block;
 
+        return 0;
+}
+
+static int brb_pop(struct bop_ring_buffer *brb)
+{
+        struct block_op *bop;
+
+        if (brb_empty(brb))
+                return -ENODATA;
+
+        bop = brb->bops + brb->begin;
         brb->begin = brb_next(brb, brb->begin);
 
         return 0;
@@ -211,7 +222,7 @@ static int apply_bops(struct sm_metadata *smm)
         while (!brb_empty(&smm->uncommitted)) {
                 struct block_op bop;
 
-                r = brb_pop(&smm->uncommitted, &bop);
+                r = brb_peek(&smm->uncommitted, &bop);
                 if (r) {
                         DMERR("bug in bop ring buffer");
                         break;
@@ -220,6 +231,8 @@ static int apply_bops(struct sm_metadata *smm)
                 r = commit_bop(smm, &bop);
                 if (r)
                         break;
+
+                brb_pop(&smm->uncommitted);
         }
 
         return r;
@@ -683,7 +696,6 @@ static struct dm_space_map bootstrap_ops = {
 static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
 {
         int r, i;
-        enum allocation_event ev;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         dm_block_t old_len = smm->ll.nr_blocks;
 
@@ -705,11 +717,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
          * allocate any new blocks.
          */
         do {
-                for (i = old_len; !r && i < smm->begin; i++) {
-                        r = sm_ll_inc(&smm->ll, i, &ev);
-                        if (r)
-                                goto out;
-                }
+                for (i = old_len; !r && i < smm->begin; i++)
+                        r = add_bop(smm, BOP_INC, i);
+
+                if (r)
+                        goto out;
+
                 old_len = smm->begin;
 
                 r = apply_bops(smm);
@@ -754,7 +767,6 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
 {
         int r;
         dm_block_t i;
-        enum allocation_event ev;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
 
         smm->begin = superblock + 1;
@@ -782,7 +794,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
          * allocated blocks that they were built from.
          */
         for (i = superblock; !r && i < smm->begin; i++)
-                r = sm_ll_inc(&smm->ll, i, &ev);
+                r = add_bop(smm, BOP_INC, i);
 
         if (r)
                 return r;