[PATCH] blk: fix tag shrinking (revive real_max_size) (ba025082) · Commits · 戴 / test

My patch in commit incorrectly removed blk_queue_tag->real_max_depth. The original resize implementation was incorrect in the following points. * actual allocation size of tag_index was shorter than real_max_size, but assumed to be of the same size, possibly causing memory access beyond the allocated area. * bits in tag_map between max_deptn and real_max_depth were initialized to 1's, making the tags permanently reserved. In an attempt to fix above two bugs, I had removed allocation optimization in init_tag_map and real_max_size. Tag map/index were allocated and freed immediately during resize. Unfortunately, I wasn't considering that tag map/index can be resized dynamically with tags beyond new_depth active. This led to accessing freed area after shrinking tags and led to the following bug reporting thread on linux-scsi. http://marc.theaimsgroup.com/?l=linux-scsi&m=112319898111885&w=2 To fix the problem, I've revived real_max_depth without allocation optimization in init_tag_map, and Andrew Vasquez confirmed that the problem was fixed. As Jens is not going to be available for a week, he asked me to make sure that this patch reaches you. http://marc.theaimsgroup.com/?l=linux-scsi&m=112325778530886&w=2 Also, a comment was added to make sure that real_max_size is needed for dynamic shrinking. Signed-off-by:

Tejun Heo <htejun@gmail.com> Signed-off-by:

Andrew Morton <akpm@osdl.org> Signed-off-by:

Linus Torvalds <torvalds@osdl.org>

drivers/block/ll_rw_blk.c

+15 −3

Original line number	Diff line number	Diff line
		@@ -719,7 +719,7 @@ struct request blk_queue_find_tag(request_queue_t q, int tag)
		{
		struct blk_queue_tag *bqt = q->queue_tags;

		if (unlikely(bqt == NULL \|\| tag >= bqt->max_depth))
		if (unlikely(bqt == NULL \|\| tag >= bqt->real_max_depth))
		return NULL;

		return bqt->tag_index[tag];
		@@ -798,6 +798,7 @@ init_tag_map(request_queue_t q, struct blk_queue_tag tags, int depth)

		memset(tag_index, 0, depth * sizeof(struct request *));
		memset(tag_map, 0, nr_ulongs * sizeof(unsigned long));
		tags->real_max_depth = depth;
		tags->max_depth = depth;
		tags->tag_index = tag_index;
		tags->tag_map = tag_map;
		@@ -871,12 +872,23 @@ int blk_queue_resize_tags(request_queue_t *q, int new_depth)
		if (!bqt)
		return -ENXIO;

		/*
		* if we already have large enough real_max_depth. just
		* adjust max_depth. NOTE as requests with tag value
		* between new_depth and real_max_depth can be in-flight, tag
		* map can not be shrunk blindly here.
		*/
		if (new_depth <= bqt->real_max_depth) {
		bqt->max_depth = new_depth;
		return 0;
		}

		/*
		* save the old state info, so we can copy it back
		*/
		tag_index = bqt->tag_index;
		tag_map = bqt->tag_map;
		max_depth = bqt->max_depth;
		max_depth = bqt->real_max_depth;

		if (init_tag_map(q, bqt, new_depth))
		return -ENOMEM;
		@@ -913,7 +925,7 @@ void blk_queue_end_tag(request_queue_t q, struct request rq)

		BUG_ON(tag == -1);

		if (unlikely(tag >= bqt->max_depth))
		if (unlikely(tag >= bqt->real_max_depth))
		/*
		* This can happen after tag depth has been reduced.
		* FIXME: how about a warning or info message here?

include/linux/blkdev.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -301,6 +301,7 @@ struct blk_queue_tag {
		struct list_head busy_list; /* fifo list of busy tags */
		int busy; /* current depth */
		int max_depth; /* what we will send to device */
		int real_max_depth; /* what the array can hold */
		atomic_t refcnt; /* map can be shared */
		};

Admin message