Revision 01f96c0a9922cd9919baf9d16febdf7016177a12 authored by NeilBrown on 21 September 2011, 05:30:20 UTC, committed by NeilBrown on 21 September 2011, 05:30:20 UTC
Two related problems: 1/ some error paths call "md_unregister_thread(mddev->thread)" without subsequently clearing ->thread. A subsequent call to mddev_unlock will try to wake the thread, and crash. 2/ Most calls to md_wakeup_thread are protected against the thread disappeared either by: - holding the ->mutex - having an active request, so something else must be keeping the array active. However mddev_unlock calls md_wakeup_thread after dropping the mutex and without any certainty of an active request, so the ->thread could theoretically disappear. So we need a spinlock to provide some protections. So change md_unregister_thread to take a pointer to the thread pointer, and ensure that it always does the required locking, and clears the pointer properly. Reported-by: "Moshe Melnikov" <moshe@zadarastorage.com> Signed-off-by: NeilBrown <neilb@suse.de> cc: stable@kernel.org
1 parent 27a7b26
File | Mode | Size |
---|---|---|
apparmor | ||
integrity | ||
keys | ||
selinux | ||
smack | ||
tomoyo | ||
Kconfig | -rw-r--r-- | 7.8 KB |
Makefile | -rw-r--r-- | 938 bytes |
capability.c | -rw-r--r-- | 23.3 KB |
commoncap.c | -rw-r--r-- | 27.2 KB |
device_cgroup.c | -rw-r--r-- | 11.4 KB |
inode.c | -rw-r--r-- | 8.7 KB |
lsm_audit.c | -rw-r--r-- | 8.9 KB |
min_addr.c | -rw-r--r-- | 1.3 KB |
security.c | -rw-r--r-- | 32.3 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...