mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
[PATCH] dm: fix rh_dec()/rh_inc() race in dm-raid1.c
Fix another bug in dm-raid1.c that the dirty region may stay in or be moved to clean list and freed while in use. It happens as follows: CPU0 CPU1 ------------------------------------------------------------------------------ rh_dec() if (atomic_dec_and_test(pending)) <the region is still marked dirty> rh_inc() if the region is clean mark the region dirty and remove from clean list mark the region clean and move to clean list atomic_inc(pending) At this stage, the region is in clean list and will be mistakenly reclaimed by rh_update_states() later. Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
e5dcdd80a6
commit
844e8d904a
1 changed files with 9 additions and 3 deletions
|
@ -375,16 +375,18 @@ static void rh_inc(struct region_hash *rh, region_t region)
|
|||
|
||||
read_lock(&rh->hash_lock);
|
||||
reg = __rh_find(rh, region);
|
||||
|
||||
atomic_inc(®->pending);
|
||||
|
||||
spin_lock_irq(&rh->region_lock);
|
||||
if (reg->state == RH_CLEAN) {
|
||||
rh->log->type->mark_region(rh->log, reg->key);
|
||||
|
||||
spin_lock_irq(&rh->region_lock);
|
||||
reg->state = RH_DIRTY;
|
||||
list_del_init(®->list); /* take off the clean list */
|
||||
spin_unlock_irq(&rh->region_lock);
|
||||
}
|
||||
spin_unlock_irq(&rh->region_lock);
|
||||
|
||||
atomic_inc(®->pending);
|
||||
read_unlock(&rh->hash_lock);
|
||||
}
|
||||
|
||||
|
@ -408,6 +410,10 @@ static void rh_dec(struct region_hash *rh, region_t region)
|
|||
|
||||
if (atomic_dec_and_test(®->pending)) {
|
||||
spin_lock_irqsave(&rh->region_lock, flags);
|
||||
if (atomic_read(®->pending)) { /* check race */
|
||||
spin_unlock_irqrestore(&rh->region_lock, flags);
|
||||
return;
|
||||
}
|
||||
if (reg->state == RH_RECOVERING) {
|
||||
list_add_tail(®->list, &rh->quiesced_regions);
|
||||
} else {
|
||||
|
|
Loading…
Reference in a new issue