tree 5e277539dab95d6325cec564a91e0e70acdce021
parent e5dcdd80a60627371f40797426273048630dc8ca
author Jun'ichi Nomura <[EMAIL PROTECTED]> Sat, 10 Sep 2005 06:23:42 -0700
committer Linus Torvalds <[EMAIL PROTECTED]> Sat, 10 Sep 2005 06:39:09 -0700

[PATCH] dm: fix rh_dec()/rh_inc() race in dm-raid1.c

Fix another bug in dm-raid1.c that the dirty region may stay in or be moved
to clean list and freed while in use.

It happens as follows:

   CPU0                                   CPU1
   
------------------------------------------------------------------------------
   rh_dec()
     if (atomic_dec_and_test(pending))
        <the region is still marked dirty>
                                          rh_inc()
                                            if the region is clean
                                               mark the region dirty
                                               and remove from clean list
        mark the region clean
        and move to clean list
                                                  atomic_inc(pending)

At this stage, the region is in clean list and will be mistakenly reclaimed
by rh_update_states() later.

Signed-off-by: Jun'ichi Nomura <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>

 drivers/md/dm-raid1.c |   12 +++++++++---
 1 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -375,16 +375,18 @@ static void rh_inc(struct region_hash *r
 
        read_lock(&rh->hash_lock);
        reg = __rh_find(rh, region);
+
+       atomic_inc(&reg->pending);
+
+       spin_lock_irq(&rh->region_lock);
        if (reg->state == RH_CLEAN) {
                rh->log->type->mark_region(rh->log, reg->key);
 
-               spin_lock_irq(&rh->region_lock);
                reg->state = RH_DIRTY;
                list_del_init(&reg->list);      /* take off the clean list */
-               spin_unlock_irq(&rh->region_lock);
        }
+       spin_unlock_irq(&rh->region_lock);
 
-       atomic_inc(&reg->pending);
        read_unlock(&rh->hash_lock);
 }
 
@@ -408,6 +410,10 @@ static void rh_dec(struct region_hash *r
 
        if (atomic_dec_and_test(&reg->pending)) {
                spin_lock_irqsave(&rh->region_lock, flags);
+               if (atomic_read(&reg->pending)) { /* check race */
+                       spin_unlock_irqrestore(&rh->region_lock, flags);
+                       return;
+               }
                if (reg->state == RH_RECOVERING) {
                        list_add_tail(&reg->list, &rh->quiesced_regions);
                } else {
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to