<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">From: Jun'ichi Nomura &lt;j-nomura@ce.jp.nec.com&gt;

Fix refcount corruption in dm-path-selector

Refcounting with non-atomic ops under shared lock will corrupt the counter
in multi-processor system and may trigger BUG_ON().
Use module refcount.
# same approach as dm-target-use-module-refcount-directly.patch here
# https://www.redhat.com/archives/dm-devel/2008-December/msg00075.html

Typical oops:
  kernel BUG at linux-2.6.29-rc3/drivers/md/dm-path-selector.c:90!
  Pid: 11148, comm: dmsetup Not tainted 2.6.29-rc3-nm #1
  dm_put_path_selector+0x4d/0x61 [dm_multipath]
  Call Trace:
   [&lt;ffffffffa031d3f9&gt;] free_priority_group+0x33/0xb3 [dm_multipath]
   [&lt;ffffffffa031d4aa&gt;] free_multipath+0x31/0x67 [dm_multipath]
   [&lt;ffffffffa031d50d&gt;] multipath_dtr+0x2d/0x32 [dm_multipath]
   [&lt;ffffffffa015d6c2&gt;] dm_table_destroy+0x64/0xd8 [dm_mod]
   [&lt;ffffffffa015b73a&gt;] __unbind+0x46/0x4b [dm_mod]
   [&lt;ffffffffa015b79f&gt;] dm_swap_table+0x60/0x14d [dm_mod]
   [&lt;ffffffffa015f963&gt;] dev_suspend+0xfd/0x177 [dm_mod]
   [&lt;ffffffffa0160250&gt;] dm_ctl_ioctl+0x24c/0x29c [dm_mod]
   [&lt;ffffffff80288cd3&gt;] ? get_page_from_freelist+0x49c/0x61d
   [&lt;ffffffffa015f866&gt;] ? dev_suspend+0x0/0x177 [dm_mod]
   [&lt;ffffffff802bf05c&gt;] vfs_ioctl+0x2a/0x77
   [&lt;ffffffff802bf4f1&gt;] do_vfs_ioctl+0x448/0x4a0
   [&lt;ffffffff802bf5a0&gt;] sys_ioctl+0x57/0x7a
   [&lt;ffffffff8020c05b&gt;] system_call_fastpath+0x16/0x1b

Cc: stable@kernel.org
Signed-off-by: Jun'ichi Nomura &lt;j-nomura@ce.jp.nec.com&gt;
Signed-off-by: Alasdair G Kergon &lt;agk@redhat.com&gt;
---
 drivers/md/dm-path-selector.c |   21 +++------------------
 1 files changed, 3 insertions(+), 18 deletions(-)

Index: linux-2.6.29/drivers/md/dm-path-selector.c
===================================================================
--- linux-2.6.29.orig/drivers/md/dm-path-selector.c	2009-04-02 16:34:52.000000000 +0100
+++ linux-2.6.29/drivers/md/dm-path-selector.c	2009-04-02 16:45:31.000000000 +0100
@@ -17,9 +17,7 @@
 
 struct ps_internal {
 	struct path_selector_type pst;
-
 	struct list_head list;
-	long use;
 };
 
 #define pst_to_psi(__pst) container_of((__pst), struct ps_internal, pst)
@@ -45,12 +43,8 @@ static struct ps_internal *get_path_sele
 
 	down_read(&amp;_ps_lock);
 	psi = __find_path_selector_type(name);
-	if (psi) {
-		if ((psi-&gt;use == 0) &amp;&amp; !try_module_get(psi-&gt;pst.module))
-			psi = NULL;
-		else
-			psi-&gt;use++;
-	}
+	if (psi &amp;&amp; !try_module_get(psi-&gt;pst.module))
+		psi = NULL;
 	up_read(&amp;_ps_lock);
 
 	return psi;
@@ -84,11 +78,7 @@ void dm_put_path_selector(struct path_se
 	if (!psi)
 		goto out;
 
-	if (--psi-&gt;use == 0)
-		module_put(psi-&gt;pst.module);
-
-	BUG_ON(psi-&gt;use &lt; 0);
-
+	module_put(psi-&gt;pst.module);
 out:
 	up_read(&amp;_ps_lock);
 }
@@ -136,11 +126,6 @@ int dm_unregister_path_selector(struct p
 		return -EINVAL;
 	}
 
-	if (psi-&gt;use) {
-		up_write(&amp;_ps_lock);
-		return -ETXTBSY;
-	}
-
 	list_del(&amp;psi-&gt;list);
 
 	up_write(&amp;_ps_lock);
</pre></body></html>