1 files changed, 92 insertions, 31 deletions

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index a67942931582..1d669322b27c 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -56,6 +56,11 @@ static void dm_hash_remove_all(int keep_open_devices);
  */
 static DECLARE_RWSEM(_hash_lock);
 
+/*
+ * Protects use of mdptr to obtain hash cell name and uuid from mapped device.
+ */
+static DEFINE_MUTEX(dm_hash_cells_mutex);
+
 static void init_buckets(struct list_head *buckets)
 {
         unsigned int i;
@@ -206,7 +211,9 @@ static int dm_hash_insert(const char *name, const char *uuid, struct mapped_devi
                 list_add(&cell->uuid_list, _uuid_buckets + hash_str(uuid));
         }
         dm_get(md);
+        mutex_lock(&dm_hash_cells_mutex);
         dm_set_mdptr(md, cell);
+        mutex_unlock(&dm_hash_cells_mutex);
         up_write(&_hash_lock);
 
         return 0;
@@ -224,9 +231,11 @@ static void __hash_remove(struct hash_cell *hc)
         /* remove from the dev hash */
         list_del(&hc->uuid_list);
         list_del(&hc->name_list);
+        mutex_lock(&dm_hash_cells_mutex);
         dm_set_mdptr(hc->md, NULL);
+        mutex_unlock(&dm_hash_cells_mutex);
 
-        table = dm_get_table(hc->md);
+        table = dm_get_live_table(hc->md);
         if (table) {
                 dm_table_event(table);
                 dm_table_put(table);
@@ -321,13 +330,15 @@ static int dm_hash_rename(uint32_t cookie, const char *old, const char *new)
          */
         list_del(&hc->name_list);
         old_name = hc->name;
+        mutex_lock(&dm_hash_cells_mutex);
         hc->name = new_name;
+        mutex_unlock(&dm_hash_cells_mutex);
         list_add(&hc->name_list, _name_buckets + hash_str(new_name));
 
         /*
          * Wake up any dm event waiters.
          */
-        table = dm_get_table(hc->md);
+        table = dm_get_live_table(hc->md);
         if (table) {
                 dm_table_event(table);
                 dm_table_put(table);
@@ -512,8 +523,6 @@ static int list_versions(struct dm_ioctl *param, size_t param_size)
         return 0;
 }
 
-
-
 static int check_name(const char *name)
 {
         if (strchr(name, '/')) {
@@ -525,6 +534,40 @@ static int check_name(const char *name)
 }
 
 /*
+ * On successful return, the caller must not attempt to acquire
+ * _hash_lock without first calling dm_table_put, because dm_table_destroy
+ * waits for this dm_table_put and could be called under this lock.
+ */
+static struct dm_table *dm_get_inactive_table(struct mapped_device *md)
+{
+        struct hash_cell *hc;
+        struct dm_table *table = NULL;
+
+        down_read(&_hash_lock);
+        hc = dm_get_mdptr(md);
+        if (!hc || hc->md != md) {
+                DMWARN("device has been removed from the dev hash table.");
+                goto out;
+        }
+
+        table = hc->new_map;
+        if (table)
+                dm_table_get(table);
+
+out:
+        up_read(&_hash_lock);
+
+        return table;
+}
+
+static struct dm_table *dm_get_live_or_inactive_table(struct mapped_device *md,
+                                                      struct dm_ioctl *param)
+{
+        return (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) ?
+                dm_get_inactive_table(md) : dm_get_live_table(md);
+}
+
+/*
  * Fills in a dm_ioctl structure, ready for sending back to
  * userland.
  */
@@ -536,7 +579,7 @@ static int __dev_status(struct mapped_device *md, struct dm_ioctl *param)
         param->flags &= ~(DM_SUSPEND_FLAG | DM_READONLY_FLAG |
                           DM_ACTIVE_PRESENT_FLAG);
 
-        if (dm_suspended(md))
+        if (dm_suspended_md(md))
                 param->flags |= DM_SUSPEND_FLAG;
 
         param->dev = huge_encode_dev(disk_devt(disk));
@@ -548,18 +591,30 @@ static int __dev_status(struct mapped_device *md, struct dm_ioctl *param)
          */
         param->open_count = dm_open_count(md);
 
-        if (get_disk_ro(disk))
-                param->flags |= DM_READONLY_FLAG;
-
         param->event_nr = dm_get_event_nr(md);
+        param->target_count = 0;
 
-        table = dm_get_table(md);
+        table = dm_get_live_table(md);
         if (table) {
-                param->flags |= DM_ACTIVE_PRESENT_FLAG;
-                param->target_count = dm_table_get_num_targets(table);
+                if (!(param->flags & DM_QUERY_INACTIVE_TABLE_FLAG)) {
+                        if (get_disk_ro(disk))
+                                param->flags |= DM_READONLY_FLAG;
+                        param->target_count = dm_table_get_num_targets(table);
+                }
                 dm_table_put(table);
-        } else
-                param->target_count = 0;
+
+                param->flags |= DM_ACTIVE_PRESENT_FLAG;
+        }
+
+        if (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) {
+                table = dm_get_inactive_table(md);
+                if (table) {
+                        if (!(dm_table_get_mode(table) & FMODE_WRITE))
+                                param->flags |= DM_READONLY_FLAG;
+                        param->target_count = dm_table_get_num_targets(table);
+                        dm_table_put(table);
+                }
+        }
 
         return 0;
 }
@@ -634,9 +689,9 @@ static struct mapped_device *find_device(struct dm_ioctl *param)
                  * Sneakily write in both the name and the uuid
                  * while we have the cell.
                  */
-                strncpy(param->name, hc->name, sizeof(param->name));
+                strlcpy(param->name, hc->name, sizeof(param->name));
                 if (hc->uuid)
-                        strncpy(param->uuid, hc->uuid, sizeof(param->uuid)-1);
+                        strlcpy(param->uuid, hc->uuid, sizeof(param->uuid));
                 else
                         param->uuid[0] = '\0';
 
@@ -784,7 +839,7 @@ static int do_suspend(struct dm_ioctl *param)
         if (param->flags & DM_NOFLUSH_FLAG)
                 suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
 
-        if (!dm_suspended(md))
+        if (!dm_suspended_md(md))
                 r = dm_suspend(md, suspend_flags);
 
         if (!r)
@@ -800,7 +855,7 @@ static int do_resume(struct dm_ioctl *param)
         unsigned suspend_flags = DM_SUSPEND_LOCKFS_FLAG;
         struct hash_cell *hc;
         struct mapped_device *md;
-        struct dm_table *new_map;
+        struct dm_table *new_map, *old_map = NULL;
 
         down_write(&_hash_lock);
 
@@ -826,14 +881,14 @@ static int do_resume(struct dm_ioctl *param)
                         suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
                 if (param->flags & DM_NOFLUSH_FLAG)
                         suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
-                if (!dm_suspended(md))
+                if (!dm_suspended_md(md))
                         dm_suspend(md, suspend_flags);
 
-                r = dm_swap_table(md, new_map);
-                if (r) {
+                old_map = dm_swap_table(md, new_map);
+                if (IS_ERR(old_map)) {
                         dm_table_destroy(new_map);
                         dm_put(md);
-                        return r;
+                        return PTR_ERR(old_map);
                 }
 
                 if (dm_table_get_mode(new_map) & FMODE_WRITE)
@@ -842,9 +897,11 @@ static int do_resume(struct dm_ioctl *param)
                         set_disk_ro(dm_disk(md), 1);
         }
 
-        if (dm_suspended(md))
+        if (dm_suspended_md(md))
                 r = dm_resume(md);
 
+        if (old_map)
+                dm_table_destroy(old_map);
 
         if (!r) {
                 dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr);
@@ -982,7 +1039,7 @@ static int dev_wait(struct dm_ioctl *param, size_t param_size)
         if (r)
                 goto out;
 
-        table = dm_get_table(md);
+        table = dm_get_live_or_inactive_table(md, param);
         if (table) {
                 retrieve_status(table, param, param_size);
                 dm_table_put(table);
@@ -1215,7 +1272,7 @@ static int table_deps(struct dm_ioctl *param, size_t param_size)
         if (r)
                 goto out;
 
-        table = dm_get_table(md);
+        table = dm_get_live_or_inactive_table(md, param);
         if (table) {
                 retrieve_deps(table, param, param_size);
                 dm_table_put(table);
@@ -1244,13 +1301,13 @@ static int table_status(struct dm_ioctl *param, size_t param_size)
         if (r)
                 goto out;
 
-        table = dm_get_table(md);
+        table = dm_get_live_or_inactive_table(md, param);
         if (table) {
                 retrieve_status(table, param, param_size);
                 dm_table_put(table);
         }
 
- out:
+out:
         dm_put(md);
         return r;
 }
@@ -1288,10 +1345,15 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
                 goto out;
         }
 
-        table = dm_get_table(md);
+        table = dm_get_live_table(md);
         if (!table)
                 goto out_argv;
 
+        if (dm_deleting_md(md)) {
+                r = -ENXIO;
+                goto out_table;
+        }
+
         ti = dm_table_find_target(table, tmsg->sector);
         if (!dm_target_is_valid(ti)) {
                 DMWARN("Target message sector outside device.");
@@ -1303,6 +1365,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
                 r = -EINVAL;
         }
 
+ out_table:
         dm_table_put(table);
  out_argv:
         kfree(argv);
@@ -1582,8 +1645,7 @@ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
         if (!md)
                 return -ENXIO;
 
-        dm_get(md);
-        down_read(&_hash_lock);
+        mutex_lock(&dm_hash_cells_mutex);
         hc = dm_get_mdptr(md);
         if (!hc || hc->md != md) {
                 r = -ENXIO;
@@ -1596,8 +1658,7 @@ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
                 strcpy(uuid, hc->uuid ? : "");
 
 out:
-        up_read(&_hash_lock);
-        dm_put(md);
+        mutex_unlock(&dm_hash_cells_mutex);
 
         return r;
 }