drbd: differentiate between normal and forced detach

Aborting local requests (not waiting for completion from the lower level
disk) is dangerous: if the master bio has been completed to upper
layers, data pages may be re-used for other things already.
If local IO is still pending and later completes,
this may cause crashes or corrupt unrelated data.

Only abort local IO if explicitly requested.
Intended use case is a lower level device that turned into a tarpit,
not completing io requests, not even doing error completion.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>

1 files changed, 16 insertions, 4 deletions

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 920ede2829d6..5bebe8d8ace3 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1630,9 +1630,21 @@ static void after_state_ch(struct drbd_conf *mdev, union drbd_state os,
                         eh = mdev->ldev->dc.on_io_error;
                         was_io_error = test_and_clear_bit(WAS_IO_ERROR, &mdev->flags);
 
-                        /* Immediately allow completion of all application IO, that waits
-                           for completion from the local disk. */
-                        tl_abort_disk_io(mdev);
+                        /* Immediately allow completion of all application IO,
+                         * that waits for completion from the local disk,
+                         * if this was a force-detach due to disk_timeout
+                         * or administrator request (drbdsetup detach --force).
+                         * Do NOT abort otherwise.
+                         * Aborting local requests may cause serious problems,
+                         * if requests are completed to upper layers already,
+                         * and then later the already submitted local bio completes.
+                         * This can cause DMA into former bio pages that meanwhile
+                         * have been re-used for other things.
+                         * So aborting local requests may cause crashes,
+                         * or even worse, silent data corruption.
+                         */
+                        if (test_and_clear_bit(FORCE_DETACH, &mdev->flags))
+                                tl_abort_disk_io(mdev);
 
                         /* current state still has to be D_FAILED,
                          * there is only one way out: to D_DISKLESS,
@@ -3870,7 +3882,7 @@ void drbd_md_sync(struct drbd_conf *mdev)
         if (!drbd_md_sync_page_io(mdev, mdev->ldev, sector, WRITE)) {
                 /* this was a try anyways ... */
                 dev_err(DEV, "meta data update failed!\n");
-                drbd_chk_io_error(mdev, 1, true);
+                drbd_chk_io_error(mdev, 1, DRBD_META_IO_ERROR);
         }
 
         /* Update mdev->ldev->md.la_size_sect,