dm raid: fix data corruption on reshape request

The lvm2 sequence to manage dm-raid constructor flags that trigger a
rebuild or a reshape is defined as:

1) load table with flags (e.g. rebuild/delta_disks/data_offset)
2) clear out the flags in lvm2 metadata
3) store the lvm2 metadata, reload the table to reset the flags
   previously established during the initial load (1) -- in order to
   prevent repeatedly requesting a rebuild or a reshape on activation

Currently, loading an inactive table with rebuild/reshape flags
specified will cause dm-raid to rebuild/reshape on resume and thus start
updating the raid metadata (about the progress).  When the second table
reload, to reset the flags, occurs the constructor accesses the volatile
progress state kept in the raid superblocks.  Because the active mapping
is still processing the rebuild/reshape, that position will be stale by
the time the device is resumed.

In the reshape case, this causes data corruption by processing already
reshaped stripes again.  In the rebuild case, it does _not_ cause data
corruption but instead involves superfluous rebuilds.

Fix by keeping the raid set frozen during the first resume and then
allow the rebuild/reshape during the second resume.

Fixes: 9dbd1aa3a ("dm raid: add reshaping support to the target")
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 4.8+

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 0460cf84fd0e74ac5141b1e5ae001c51156d373f..350527f6083412c3e40285f5d99673443bc7a929 100644 (file)
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3756,6 +3756,8 @@ static int raid_preresume(struct dm_target *ti)
        return r;
 }
 
+#define RESUME_STAY_FROZEN_FLAGS (CTR_FLAG_DELTA_DISKS | CTR_FLAG_DATA_OFFSET)
+
 static void raid_resume(struct dm_target *ti)
 {
        struct raid_set *rs = ti->private;
@@ -3773,7 +3775,15 @@ static void raid_resume(struct dm_target *ti)
        mddev->ro = 0;
        mddev->in_sync = 0;
 
-       clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+       /*
+        * Keep the RAID set frozen if reshape/rebuild flags are set.
+        * The RAID set is unfrozen once the next table load/resume,
+        * which clears the reshape/rebuild flags, occurs.
+        * This ensures that the constructor for the inactive table
+        * retrieves an up-to-date reshape_position.
+        */
+       if (!(rs->ctr_flags & RESUME_STAY_FROZEN_FLAGS))
+               clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
 
        if (mddev->suspended)
                mddev_resume(mddev);