• Joe Thornber's avatar
    dm transaction manager: fix corruption due to non-atomic transaction commit · a9d45396
    Joe Thornber authored
    The persistent-data library used by dm-thin, dm-cache, etc is
    transactional.  If anything goes wrong, such as an io error when writing
    new metadata or a power failure, then we roll back to the last
    transaction.
    
    Atomicity when committing a transaction is achieved by:
    
    a) Never overwriting data from the previous transaction.
    b) Writing the superblock last, after all other metadata has hit the
       disk.
    
    This commit and the following commit ("dm: take care to copy the space
    map roots before locking the superblock") fix a bug associated with (b).
    When committing it was possible for the superblock to still be written
    in spite of an io error occurring during the preceeding metadata flush.
    With these commits we're careful not to take the write lock out on the
    superblock until after the metadata flush has completed.
    
    Change the transaction manager's semantics for dm_tm_commit() to assume
    all data has been flushed _before_ the single superblock that is passed
    in.
    
    As a prerequisite, split the block manager's block unlocking and
    flushing by simplifying dm_bm_flush_and_unlock() to dm_bm_flush().  Now
    the unlocking must be done separately.
    
    This issue was discovered by forcing io errors at the crucial time
    using dm-flakey.
    Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    Cc: stable@vger.kernel.org
    a9d45396
dm-cache-metadata.c 29.8 KB