Nbd is broken

From: Pavel Machek (pavel@suse.cz)
Date: Fri Mar 03 2000 - 18:04:02 EST

Hi!

While updating nbd, fatal errors sneaked in. Here is patch that makes
it better, but not ok. I was not able to repair within hour :-(.

                                                                Pavel

--- clean/drivers/block/nbd.c Mon Feb 21 10:32:22 2000
+++ linux/drivers/block/nbd.c Fri Mar 3 23:55:19 2000
@@ -4,7 +4,7 @@
  * Note that you can not swap over this thing, yet. Seems to work but
  * deadlocks sometimes - you can not swap over TCP in general.
  *
- * Copyright 1997 Pavel Machek <pavel@atrey.karlin.mff.cuni.cz>
+ * Copyright 1997-2000 Pavel Machek <pavel@ucw.cz>
  *
  * (part of code stolen from loop.c)
  *
@@ -77,6 +77,7 @@
         nbd_dev[dev].refcnt++;
         if (!(nbdev->flags & NBD_INITIALISED)) {
                 init_MUTEX(&nbdev->queue_lock);
+ INIT_LIST_HEAD(&nbdev->queue_head);
                 nbdev->flags |= NBD_INITIALISED;
         }
         MOD_INC_USE_COUNT;
@@ -218,7 +219,10 @@
 
         down (&lo->queue_lock);
         while (!list_empty(&lo->queue_head)) {
+ up (&lo->queue_lock);
                 req = nbd_read_stat(lo);
+ down (&lo->queue_lock);
+
                 if (!req)
                         goto out;
 #ifdef PARANOIA
@@ -249,17 +253,22 @@
 {
         struct request *req;
 
+#ifdef PARANOIA
+ if (lo->magic != LO_MAGIC) {
+ printk(KERN_ERR "NBD: nbd_dev[] corrupted: Not enough magic when clearing!\n");
+ return;
+ }
+#endif
+
         while (!list_empty(&lo->queue_head)) {
                 req = blkdev_entry_prev_request(&lo->queue_head);
+ if (!req)
+ break;
 #ifdef PARANOIA
                 if (lo != &nbd_dev[MINOR(req->rq_dev)]) {
                         printk(KERN_ALERT "NBD: request corrupted when clearing!\n");
                         continue;
                 }
- if (lo->magic != LO_MAGIC) {
- printk(KERN_ERR "NBD: nbd_dev[] corrupted: Not enough magic when clearing!\n");
- return;
- }
 #endif
                 req->errors++;
                 list_del(&req->queue);
@@ -289,6 +298,10 @@
 
         while (!QUEUE_EMPTY) {
                 req = CURRENT;
+#ifdef PARANOIA
+ if (!req)
+ FAIL("que not empty but no request?");
+#endif
                 dev = MINOR(req->rq_dev);
 #ifdef PARANOIA
                 if (dev >= MAX_NBD)
@@ -309,7 +322,9 @@
                 spin_unlock_irq(&io_request_lock);
 
                 down (&lo->queue_lock);
+printk("8\n");
                 list_add(&req->queue, &lo->queue_head);
+printk("9\n");
                 nbd_send_req(lo->sock, req); /* Why does this block? */
                 up (&lo->queue_lock);
  

-- 
I'm pavel@ucw.cz. "In my country we have almost anarchy and I don't care."
Panos Katsaloulis describing me w.r.t. patents me at discuss@linmodems.org

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Tue Mar 07 2000 - 21:00:16 EST