summaryrefslogtreecommitdiff
path: root/drivers/md/md.c
diff options
context:
space:
mode:
authorGuoqing Jiang <guoqing.jiang@cloud.ionos.com>2022-04-29 11:49:09 +0300
committerSong Liu <song@kernel.org>2022-05-23 09:07:21 +0300
commit1e267742283a4b5a8ca65755c44166be27e9aa0f (patch)
tree58e8575c119e1b6b69a440ccfee1efdb69a54611 /drivers/md/md.c
parent8b48ec23cc51a4e7c8dbaef5f34ebe67e1a80934 (diff)
downloadlinux-1e267742283a4b5a8ca65755c44166be27e9aa0f.tar.xz
md: protect md_unregister_thread from reentrancy
Generally, the md_unregister_thread is called with reconfig_mutex, but raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread, so md_unregister_thread can be called simulitaneously from two call sites in theory. Then after previous commit which remove the protection of reconfig_mutex for md_unregister_thread completely, the potential issue could be worse than before. Let's take pers_lock at the beginning of function to ensure reentrancy. Reported-by: Donald Buczek <buczek@molgen.mpg.de> Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev> Signed-off-by: Song Liu <song@kernel.org>
Diffstat (limited to 'drivers/md/md.c')
-rw-r--r--drivers/md/md.c15
1 files changed, 10 insertions, 5 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 1958a14a0c79..53787a32166d 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7963,17 +7963,22 @@ EXPORT_SYMBOL(md_register_thread);
void md_unregister_thread(struct md_thread **threadp)
{
- struct md_thread *thread = *threadp;
- if (!thread)
- return;
- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- /* Locking ensures that mddev_unlock does not wake_up a
+ struct md_thread *thread;
+
+ /*
+ * Locking ensures that mddev_unlock does not wake_up a
* non-existent thread
*/
spin_lock(&pers_lock);
+ thread = *threadp;
+ if (!thread) {
+ spin_unlock(&pers_lock);
+ return;
+ }
*threadp = NULL;
spin_unlock(&pers_lock);
+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
kthread_stop(thread->tsk);
kfree(thread);
}