samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dm-mirror: fix a tiny race condition

Browse Source 
commit 829451beaed6165eb11d7a9fb4e28eb17f489980 upstream.

There's a tiny race condition in dm-mirror. The functions queue_bio and
write_callback grab a spinlock, add a bio to the list, drop the spinlock
and wake up the mirrord thread that processes bios in the list.

It may be possible that the mirrord thread processes the bio just after
spin_unlock_irqrestore is called, before wakeup_mirrord. This spurious
wake-up is normally harmless, however if the device mapper device is
unloaded just after the bio was processed, it may be possible that
wakeup_mirrord(ms) uses invalid "ms" pointer.

Fix this bug by moving wakeup_mirrord inside the spinlock.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Mikulas Patocka
2025-06-03 18:53:17 +02:00
committed by Greg Kroah-Hartman
parent fe0ff7d801
commit 61850a1b26
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/md/dm-raid1.c
View File

@@ -133,10 +133,9 @@ static void queue_bio(struct mirror_set *ms, struct bio *bio, int rw)
spin_lock_irqsave(&ms->lock, flags); spin_lock_irqsave(&ms->lock, flags);
should_wake = !(bl->head); should_wake = !(bl->head);
bio_list_add(bl, bio); bio_list_add(bl, bio);
spin_unlock_irqrestore(&ms->lock, flags);
if (should_wake) if (should_wake)
wakeup_mirrord(ms); wakeup_mirrord(ms);
spin_unlock_irqrestore(&ms->lock, flags);
} }
static void dispatch_bios(void *context, struct bio_list *bio_list) static void dispatch_bios(void *context, struct bio_list *bio_list)
@@ -646,9 +645,9 @@ static void write_callback(unsigned long error, void *context)
if (!ms->failures.head) if (!ms->failures.head)
should_wake = 1; should_wake = 1;
bio_list_add(&ms->failures, bio); bio_list_add(&ms->failures, bio);
spin_unlock_irqrestore(&ms->lock, flags);
if (should_wake) if (should_wake)
wakeup_mirrord(ms); wakeup_mirrord(ms);
spin_unlock_irqrestore(&ms->lock, flags);
} }
static void do_write(struct mirror_set *ms, struct bio *bio) static void do_write(struct mirror_set *ms, struct bio *bio)