From: "Jun'ichi Nomura" <j-nomura@ce.jp.nec.com>
To: device-mapper development <dm-devel@redhat.com>,
Alasdair Kergon <agk@redhat.com>
Cc: linux-kernel@vger.kernel.org
Subject: [PATCH] 2.6.12-rc6: fix __rh_alloc()/rh_update_states() race in dm-raid1.c
Date: Thu, 16 Jun 2005 18:11:57 -0400 [thread overview]
Message-ID: <42B1F92D.3040108@ce.jp.nec.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 1051 bytes --]
Hello,
the attached patch fixes the bug in dm-raid1.c that
the region returned by __rh_alloc() may be freed while
it's in use.
__rh_alloc() write-unlocks the hash_lock after inserting the new region.
Though it read-locks the hash-lock just after that, it's possible
that the region was reclaimed by rh_update_states() as the region
was clean at the time.
CPU0 CPU1
-----------------------------------------------------------------------
__rh_alloc()
write_lock(hash_lock)
<insert new region to clean list>
write_unlock(hash_lock)
rh_update_states()
write_lock(hash_lock)
<move clean regions to freeable list>
write_unlock(hash_lock)
<free regions in the freeable list>
read_lock(hash_lock)
<return the region>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
[-- Attachment #2: dm-raid1-race1.patch --]
[-- Type: text/x-patch, Size: 370 bytes --]
--- kernel/drivers/md/dm-raid1.c.orig 2005-06-16 07:13:50.610325768 -0400
+++ kernel/drivers/md/dm-raid1.c 2005-06-16 10:34:12.510719112 -0400
@@ -269,9 +269,12 @@ static inline struct region *__rh_find(s
{
struct region *reg;
+retry:
reg = __rh_lookup(rh, region);
- if (!reg)
+ if (!reg) {
reg = __rh_alloc(rh, region);
+ goto retry;
+ }
return reg;
}
reply other threads:[~2005-06-16 22:12 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=42B1F92D.3040108@ce.jp.nec.com \
--to=j-nomura@ce.jp.nec.com \
--cc=agk@redhat.com \
--cc=dm-devel@redhat.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).