]> git.ipfire.org Git - thirdparty/linux.git/commit
dm-mirror: fix a tiny race condition
authorMikulas Patocka <mpatocka@redhat.com>
Tue, 3 Jun 2025 16:53:17 +0000 (18:53 +0200)
committerMikulas Patocka <mpatocka@redhat.com>
Tue, 3 Jun 2025 17:01:23 +0000 (19:01 +0200)
commit829451beaed6165eb11d7a9fb4e28eb17f489980
treebb3b87ec6cdfca33f93d209e2c17dcc05f6f4211
parent85f6d5b729eaace1549f1dcc284d9865f2c3ec02
dm-mirror: fix a tiny race condition

There's a tiny race condition in dm-mirror. The functions queue_bio and
write_callback grab a spinlock, add a bio to the list, drop the spinlock
and wake up the mirrord thread that processes bios in the list.

It may be possible that the mirrord thread processes the bio just after
spin_unlock_irqrestore is called, before wakeup_mirrord. This spurious
wake-up is normally harmless, however if the device mapper device is
unloaded just after the bio was processed, it may be possible that
wakeup_mirrord(ms) uses invalid "ms" pointer.

Fix this bug by moving wakeup_mirrord inside the spinlock.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
drivers/md/dm-raid1.c