From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id C33FC8045D for ; Wed, 4 Nov 2026 08:43:58 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A48gdQv022368; Wed, 4 Nov 2026 11:42:40 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A48gdQv022368 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="cNv+HMm5" Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A48gb1q022340 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 4 Nov 2026 11:42:37 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A48gb1q022340 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-49953abe51fso3886495e9.1 for ; Wed, 04 Nov 2026 00:42:37 -0800 (PST) X-Gm-Message-State: APuU4Z9H9JbQsVYqe9zMgNkF9TGF8iTYYfa9iSz+VkIJcAJi0mLtBqnq 1BhD6FQBQkqGqMBhevfJnZpOfsXOnKV28bO/Hcazn/U/oOC+RdQKlR4M/mkq0UjsJ5JT2ikPxit XULSuMRDSCm2EChSIeWdbRxmx6m7Ir4pT6xQqzX/VrxjP4XWjw2QvMA== X-Gm-Gg: AYBFou22YINfU7e7WSPh+USoHFOHPOLvWU5yFQcjctqIUwwDlJcca39BBAvnJB2jlnG 8LKfrGwctxIqYBysWSgu4+NrR15B8PvOZYmvFIlQhIPFQrDX1gGKflSNPfaPWmMfQv3Jd7aDhdR jbTrrOvTY2+ot4sc4AIQVCZPazAUZa/2hn+2AXbXq963BaCuwzFTnnqT0xUDko92N0OBZ1TWls7 HCRKMAadHHhTU+8mooBzHzX/mPsLl76UU6oyPVI80dXX1m8fLi9Lo9zLBGKbGaiyjK1+Uek/4gT 0oRe/VpuLSyBpI0fld5rdg1Nux/RyKLxlprx3OUmfpY5AHGIuyEzP3XyN7jGaK7QX5AJ+/iMa6m MbOwH06P986GzDK0X0SrnPtwhp1MdIQ== X-Received: by 2002:a05:600c:e41a:b0:4b2:406b:f3bd with SMTP id 5b1f17b1804b1-4b2406bf3d2mr111423365e9.23.1793781757199; Wed, 04 Nov 2026 00:42:37 -0800 (PST) X-Received: by 2002:a05:600c:e41a:b0:4b2:406b:f3bd with SMTP id 5b1f17b1804b1-4b2406bf3d2mr111423025e9.23.1793781756697; Wed, 04 Nov 2026 00:42:36 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793781756; cv=none; d=google.com; s=arc-20260327; b=Dx29bI8a8ZfrktVvyzPKNZsGNyirEscEEA83JgkyS/uNSTrOxZ6gx4dstwDFKcsnJK 6sOQnnzQCZiQuz8TvoCr4JggKNUkdljtwD2w31IZ5iedKj7nZR/gH7jlmZRFbZq9r/CN bTjiongk0i3OuchCx+IW4X+Ggrb5GI42Y/butDDutGOygNFuwKnx+3a5Gpp70RVUWFyD hXL4uvyic/IFarFEWZGT75gg08ky2p560sOPN0TkGTL89qUxacKZ0t9tfYEjAvPZsTTD MEYmeFrraUBYFLKGC98Tqdkp+1h+j9mK+V/Cwuf9RvOXBuCZKYfj62brclcMZfwtJG2e gZzQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=MXMgjWTEqSAuBakVzf1P1QBWvD3gqF5YXM1p6uJ5GPQ=; fh=ElTTnnNtphHTCCOZ+58STyaWac7y7ytLDJZIF4HMMJ4=; b=OjvUBSzQ+Me37SZ3X9AMDnIOqaPvX0EhrgqKXR3DsCh90LSwHrNXWqXb8v60tQ5igV J2Mko2CnkBgSs9vTEEABHwtiD6JXKpsm5J0GVoiCCFK5XZheNsjJ/i3bzh7LBMmCzaIz jJNVsSohf+Aao5to/hE+mjxjIvgZyL6QTFfKzmt9VTLc6hSDdAGczi3pODYbEj+RvoZy bDTZk+4rUhuxeiZO/0IbSUO5oRw4IXRExDLIqCBaMdVy/wQmUcxDnv69SCyuEs7Cqynt 1vKUgRoUSayuBzl8zFNB2fTbWmWDtrXYrZaVIzLucZeuFGB/WY2VueACA7MoV4RxPwOy pybQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=cNv+HMm5; spf=pass (google.com: domain of andrey.zhadchenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=andrey.zhadchenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id 5b1f17b1804b1-4b2a9604b8bsi144764235e9.1.2026.11.04.00.42.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 00:42:36 -0800 (PST) Received-SPF: pass (google.com: domain of andrey.zhadchenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=cNv+HMm5; spf=pass (google.com: domain of andrey.zhadchenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=andrey.zhadchenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=MXMgjWTEqSAuBakVzf1P1QBWvD3gqF5YXM1p6uJ5GPQ=; b=cNv+HMm54eS9 yGELKjb3iDpJARcgvdx5tegM5Fxc5O+q3NTTXIV/3Pg25ND8R9v5PHE7iF2PP+d+EYqSiDJAeuh2N QatB2QtiRVeVeYbXH1Q23h9vDvz/F6piilxQQ3bOmh8yF9JFrkfYLtdtQSEE54+y6IZr30LXN67+1 GdBd+qIu9Sba8Sy7Ed8YDCwxLCKe82US6dXvAn4TJKQY/SPR3FmZPicg80/nxV+XMS8OJxuCiwGfC CTIGAhq4o3MciNZsSqUs5u8AquefMvfCT8uP/3Xl9P1QWVbWReo8ewHcgtkV7onhwAr4RUz+nzAnh UwD7MeiDc2hEsPx3YCLqeA==; Received: from [130.117.225.5] (helo=vz9-demens-1.aci.vzint.dev) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xOWVr-005ttV-2S; Wed, 04 Nov 2026 09:42:35 +0100 From: Andrey Zhadchenko To: khorenko@virtuozzo.com, alexander.ivanov@virtuozzo.com Date: Wed, 4 Nov 2026 11:38:11 +0300 Message-ID: <20261104083818.856720-1-andrey.zhadchenko@virtuozzo.com> X-Mailer: git-send-email 2.43.5 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v6 0/7] dm/push_backup: event fd interface and fixes X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The push_backup target currently makes the backup tool wait for the next cluster range inside the "push_backup_read" target message. dm runs target_message() under dm_get_live_table(), i.e. with md->io_barrier SRCU read-locked, so while the tool sleeps there anything that needs synchronize_srcu(&md->io_barrier) on that device is stuck: suspend, table reload/remove and dm_internal_suspend_fast() from "@stats_create". An unrelated dm-stats user hangs, and everything that later queues behind md->suspend_lock hangs with it. Patch 7 adds a file descriptor based interface instead. The tool gets an anon inode fd via the "push_backup_get_fd" message and then uses plain read()/write() of struct dm_push_backup_range to fetch the next range and to acknowledge it, without going through dm messages on the data path. The fd pins struct push_backup with a kref so it survives target removal and simply fails with ENODEV afterwards. The fd is bound to the target, not to a backup session. The legacy messages are kept for compatibility. Patches 1-6 are fixes found while working on this: 1. init the lock, waitqueue and timer before anything that can fail so pb_destroy() is safe on every error path of pb_ctr(); 2. return -ENOMEM when the workqueue allocation fails. pb_ctr() returned 0 after freeing pb, and pb_dtr() freed it again; 3. clear pb->alive under pb->lock like the other users do; 4. pass absolute expiry to mod_timer(). All callers passed a relative value, which is always in the past, so the timer fired and re-armed on every tick while a write was delayed; 5. arm the timer under pb->lock and wait for its callback properly. pb_timer_func() and postpone_if_required_for_backup() both decided under the lock and armed after dropping it, so the callback's stale S64_MAX could overwrite a fresh deadline while writes were delayed. timer_delete_sync_try() does not wait for a running callback, so a firing after the synchronize_rcu() grace period could outlive push_backup_stop() and expire a later session, or run under pb_destroy() and use pb after it is freed. With arming done under the lock, the callback checking pb->nr_delayed and stop/destroy waiting via timer_delete_sync()/timer_shutdown_sync(), the RCU dance between postpone and stop is no longer needed and is removed; 6. drop the redundant mod_timer() in push_backup_write(). The timer re-arms itself from pb->deadline_jiffies while writes are delayed, so updating the deadline under the lock is enough. The call was not under pb->lock, which matters once writes may arrive via the fd without pb->ctl_rwsem. v6: - all: subject prefix changed to dm/push_backup, added Feature: tag. - 7/7: dropped O_NONBLOCK support, read() always blocks. v5: - 1/7: commit message: safe on every error path of pb_ctr(), the zeroed timer triggers an ODEBUG warning on debug kernels. - 2/7: new patch. - 4/7, 5/7, 6/7: reordered so that the timer is armed under pb->lock before push_backup_write() stops re-arming it; no bisect point has the race window. 4/7 now also fixes the mod_timer() call in push_backup_write(). - 4/7: commit message: the relative expiry is always in the past. - 5/7: pb_timer_func() checks pb->nr_delayed instead of pb->alive, so a "push_backup_stop" interrupted before taking pb->ctl_rwsem still expires the deadline. Commit message describes the race, the synchronize_rcu() window and the pb_destroy() use-after-free. Added Fixes: tag. - 6/7: dropped the "only place" claim. - 7/7: header documents that the fd survives stop/start, errno semantics, the EINTR/EFAULT/EBADMSG and write() errors, O_CLOEXEC and that "dmsetup message" is of no use. pb_destroy() NULLs the pointers it frees. checkpatch blank line. Commit message mentions the legacy u64 parsing changes and the version bump, and corrects the resubmit_pbios() rationale. Patch numbers below refer to the 6-patch v4 numbering. v4: - 3/6, 6/6: commit message typos. - 4/6: added Fixes: tag. v3: - 5/6: pb_timer_func() bails out when !pb->alive; push_backup_stop() uses timer_delete_sync() and pb_destroy() timer_shutdown_sync() instead of WARNing on timer_delete_sync_try() < 0, which never waited for a running callback. Commit message corrected accordingly. - 6/6: push_backup_get_fd() installs the fd only after its number fits into the result buffer (reserve -> emit -> check -> install), so a too small buffer no longer leaks the fd with its pb kref and module reference. pb->dead renamed to pb->destroyed. UAPI type namespaced as struct dm_push_backup_range. read() now requires exactly sizeof(range) like write(). Subject prefix aligned with the rest of the series. v2: - 2/6: reworded the commit message, dropped the KCSAN claim. - 5/6: new patch: arm the deadline timer under pb->lock and drop the rcu_read_lock()/synchronize_rcu() between postpone_if_required_for_backup() and push_backup_stop(). - 6/6: resubmit_pbios() now frees the pbio before dm_requeue_original_rq(). The requeue drops the md reference held by the in-flight request, after which __dm_destroy() may run .dtr and destroy pbio_pool under the fd writer's feet. https://virtuozzo.atlassian.net/browse/VSTOR-152912 Andrey Zhadchenko (7): dm/push_backup: correct initialization dm/push_backup: return error if workqueue allocation fails dm/push_backup: clear pb->alive under pb->lock dm/push_backup: fix mod_timer() usage dm/push_backup: arm deadline timer under pb->lock dm/push_backup: do not re-arm deadline timer in push_backup_write() dm/push_backup: add event file descriptor interface drivers/md/dm-push-backup.c | 273 +++++++++++++++++++++------- include/uapi/linux/dm-push-backup.h | 47 +++++ 2 files changed, 259 insertions(+), 61 deletions(-) create mode 100644 include/uapi/linux/dm-push-backup.h -- 2.43.5 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel