mirror of
https://github.com/torvalds/linux.git
synced 2024-11-27 22:51:35 +00:00
8434ffe71c
There is a race in ceph_put_snap_realm. The change to the nref and the spinlock acquisition are not done atomically, so you could decrement nref, and before you take the spinlock, the nref is incremented again. At that point, you end up putting it on the empty list when it shouldn't be there. Eventually __cleanup_empty_realms runs and frees it when it's still in-use. Fix this by protecting the 1->0 transition with atomic_dec_and_lock, and just drop the spinlock if we can get the rwsem. Because these objects can also undergo a 0->1 refcount transition, we must protect that change as well with the spinlock. Increment locklessly unless the value is at 0, in which case we take the spinlock, increment and then take it off the empty list if it did the 0->1 transition. With these changes, I'm removing the dout() messages from these functions, as well as in __put_snap_realm. They've always been racy, and it's better to not print values that may be misleading. Cc: stable@vger.kernel.org URL: https://tracker.ceph.com/issues/46419 Reported-by: Mark Nelson <mnelson@redhat.com> Signed-off-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Luis Henriques <lhenriques@suse.de> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> |
||
|---|---|---|
| .. | ||
| acl.c | ||
| addr.c | ||
| cache.c | ||
| cache.h | ||
| caps.c | ||
| ceph_frag.c | ||
| debugfs.c | ||
| dir.c | ||
| export.c | ||
| file.c | ||
| inode.c | ||
| io.c | ||
| io.h | ||
| ioctl.c | ||
| ioctl.h | ||
| Kconfig | ||
| locks.c | ||
| Makefile | ||
| mds_client.c | ||
| mds_client.h | ||
| mdsmap.c | ||
| metric.c | ||
| metric.h | ||
| quota.c | ||
| snap.c | ||
| strings.c | ||
| super.c | ||
| super.h | ||
| util.c | ||
| xattr.c | ||