summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDennis Yang <dennisyang@qnap.com>2017-09-06 05:02:35 +0200
committerShaohua Li <shli@fb.com>2017-09-06 07:51:13 +0200
commit184a09eb9a2fe425e49c9538f1604b05ed33cfef (patch)
tree55ce37e0f498dbdae51edeb3516bb086bc65c0f2
parentmd/raid5: fix a race condition in stripe batch (diff)
downloadlinux-184a09eb9a2fe425e49c9538f1604b05ed33cfef.tar.xz
linux-184a09eb9a2fe425e49c9538f1604b05ed33cfef.zip
md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list
In release_stripe_plug(), if a stripe_head has its STRIPE_ON_UNPLUG_LIST set, it indicates that this stripe_head is already in the raid5_plug_cb list and release_stripe() would be called instead to drop a reference count. Otherwise, the STRIPE_ON_UNPLUG_LIST bit would be set for this stripe_head and it will get queued into the raid5_plug_cb list. Since break_stripe_batch_list() did not preserve STRIPE_ON_UNPLUG_LIST, A stripe could be re-added to plug list while it is still on that list in the following situation. If stripe_head A is added to another stripe_head B's batch list, in this case A will have its batch_head != NULL and be added into the plug list. After that, stripe_head B gets handled and called break_stripe_batch_list() to reset all the batched stripe_head(including A which is still on the plug list)'s state and reset their batch_head to NULL. Before the plug list gets processed, if there is another write request comes in and get stripe_head A, A will have its batch_head == NULL (cleared by calling break_stripe_batch_list() on B) and be added to plug list once again. Signed-off-by: Dennis Yang <dennisyang@qnap.com> Cc: stable@vger.kernel.org (v4.1+) Signed-off-by: Shaohua Li <shli@fb.com>
-rw-r--r--drivers/md/raid5.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 90414a4e0d49..34c01e83395a 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4605,7 +4605,8 @@ static void break_stripe_batch_list(struct stripe_head *head_sh,
set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS |
(1 << STRIPE_PREREAD_ACTIVE) |
- (1 << STRIPE_DEGRADED)),
+ (1 << STRIPE_DEGRADED) |
+ (1 << STRIPE_ON_UNPLUG_LIST)),
head_sh->state & (1 << STRIPE_INSYNC));
sh->check_state = head_sh->check_state;