diff options
author | Joe Thornber <ejt@redhat.com> | 2013-12-13 09:55:55 -0500 |
---|---|---|
committer | Mike Snitzer <snitzer@redhat.com> | 2013-12-13 14:22:10 -0500 |
commit | ed9571f0cf1fe09d3506302610f3ccdfa1d22c4a (patch) | |
tree | ec013b939d466fbd06d3c62a5a0de5ca9e5a3ae1 /drivers/md/persistent-data | |
parent | 5b564d80f8bc21094c0cd2b19b679d983aabcc29 (diff) |
dm array: fix a reference counting bug in shadow_ablock
An old array block could have its reference count decremented below
zero when it is being replaced in the btree by a new array block.
The fix is to increment the old ablock's reference count just before
inserting a new ablock into the btree.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 3.9+
Diffstat (limited to 'drivers/md/persistent-data')
-rw-r--r-- | drivers/md/persistent-data/dm-array.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c index af96e24ec328..1d75b1dc1e2e 100644 --- a/drivers/md/persistent-data/dm-array.c +++ b/drivers/md/persistent-data/dm-array.c | |||
@@ -317,8 +317,16 @@ static int shadow_ablock(struct dm_array_info *info, dm_block_t *root, | |||
317 | * The shadow op will often be a noop. Only insert if it really | 317 | * The shadow op will often be a noop. Only insert if it really |
318 | * copied data. | 318 | * copied data. |
319 | */ | 319 | */ |
320 | if (dm_block_location(*block) != b) | 320 | if (dm_block_location(*block) != b) { |
321 | /* | ||
322 | * dm_tm_shadow_block will have already decremented the old | ||
323 | * block, but it is still referenced by the btree. We | ||
324 | * increment to stop the insert decrementing it below zero | ||
325 | * when overwriting the old value. | ||
326 | */ | ||
327 | dm_tm_inc(info->btree_info.tm, b); | ||
321 | r = insert_ablock(info, index, *block, root); | 328 | r = insert_ablock(info, index, *block, root); |
329 | } | ||
322 | 330 | ||
323 | return r; | 331 | return r; |
324 | } | 332 | } |