Andrew Lukoshko
b9d46fff46
Add the RHEL 211.17.1..211.18.1 backports (1162-1244) from centos-stream-10 and upstream, on top of 211.16.1. Includes the lpfc 14.4.0.x revert batch and the RHEL-only lpfc_nlp_get UAF guard. Bump to 211.18.1.
56 lines
2.0 KiB
Diff
56 lines
2.0 KiB
Diff
From 323d252a4a378834e4fe68298ca61cfc5dd3a460 Mon Sep 17 00:00:00 2001
|
|
From: Mikulas Patocka <mpatocka@redhat.com>
|
|
Date: Mon, 20 Apr 2026 19:56:44 +0200
|
|
Subject: [PATCH] dm-thin: fix metadata refcount underflow
|
|
|
|
commit 09a65adc7d8bbfce06392cb6d375468e2728ead5 upstream.
|
|
|
|
There's a bug in dm-thin in the function rebalance_children. If the
|
|
internal btree node has one entry, the code tries to copy all btree
|
|
entries from the node's child to the node itself and then decrement the
|
|
child's reference count.
|
|
|
|
If the child node is shared (it has reference count > 1), we won't free
|
|
it, so there would be two pointers to each of the grandchildren nodes.
|
|
But the reference counts of the grandchildren is not increased, thus the
|
|
reference count doesn't match the number of pointers that point to the
|
|
grandchildren. This results in "device mapper: space map common: unable
|
|
to decrement block" errors.
|
|
|
|
Fix this bug by incrementing reference counts on the grandchildren if the
|
|
btree node is shared.
|
|
|
|
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
|
|
Fixes: 3241b1d3e0aa ("dm: add persistent data library")
|
|
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
|
|
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
|
|
index 942cd47eb52d..aeec5b9a1dd5 100644
|
|
--- a/drivers/md/persistent-data/dm-btree-remove.c
|
|
+++ b/drivers/md/persistent-data/dm-btree-remove.c
|
|
@@ -490,12 +490,20 @@ static int rebalance_children(struct shadow_spine *s,
|
|
|
|
if (le32_to_cpu(n->header.nr_entries) == 1) {
|
|
struct dm_block *child;
|
|
+ int is_shared;
|
|
dm_block_t b = value64(n, 0);
|
|
|
|
+ r = dm_tm_block_is_shared(info->tm, b, &is_shared);
|
|
+ if (r)
|
|
+ return r;
|
|
+
|
|
r = dm_tm_read_lock(info->tm, b, &btree_node_validator, &child);
|
|
if (r)
|
|
return r;
|
|
|
|
+ if (is_shared)
|
|
+ inc_children(info->tm, dm_block_data(child), vt);
|
|
+
|
|
memcpy(n, dm_block_data(child),
|
|
dm_bm_block_size(dm_tm_get_bm(info->tm)));
|
|
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|