From: NeilBrown Date: Wed, 22 Jan 2014 00:45:03 +0000 (+1100) Subject: md/raid5: close recently introduced race in stripe_head management. X-Git-Tag: v3.14-rc1~101^2 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7da9d450ab2843bf1db378c156acc6304dbc1c2b;p=pandora-kernel.git md/raid5: close recently introduced race in stripe_head management. As release_stripe and __release_stripe decrement ->count and then manipulate ->lru both under ->device_lock, it is important that get_active_stripe() increments ->count and clears ->lru also under ->device_lock. However we currently list_del_init ->lru under the lock, but increment the ->count outside the lock. This can lead to races and list corruption. So move the atomic_inc(&sh->count) up inside the ->device_lock protected region. Note that we still increment ->count without device lock in the case where get_free_stripe() was called, and in fact don't take ->device_lock at all in that path. This is safe because if the stripe_head can be found by get_free_stripe, then the hash lock assures us the no-one else could possibly be calling release_stripe() at the same time. Fixes: 566c09c53455d7c4f1130928ef8071da1a24ea65 Cc: stable@vger.kernel.org (3.13) Reported-and-tested-by: Ian Kumlien Signed-off-by: NeilBrown --- Reading git-diff-tree failed