[PATCH] dm: fix rh_dec()/rh_inc() race in dm-raid1.c
authorJun'ichi Nomura <j-nomura@ce.jp.nec.com>
Fri, 9 Sep 2005 23:23:42 +0000 (16:23 -0700)
committerLinus Torvalds <torvalds@g5.osdl.org>
Fri, 9 Sep 2005 23:39:09 +0000 (16:39 -0700)
commit844e8d904a7c1446e3f040683b4a0645c3eb168f
tree5e277539dab95d6325cec564a91e0e70acdce021
parente5dcdd80a60627371f40797426273048630dc8ca
[PATCH] dm: fix rh_dec()/rh_inc() race in dm-raid1.c

Fix another bug in dm-raid1.c that the dirty region may stay in or be moved
to clean list and freed while in use.

It happens as follows:

   CPU0                                   CPU1
   ------------------------------------------------------------------------------
   rh_dec()
     if (atomic_dec_and_test(pending))
        <the region is still marked dirty>
                                          rh_inc()
                                            if the region is clean
                                               mark the region dirty
                                               and remove from clean list
        mark the region clean
        and move to clean list
                                                  atomic_inc(pending)

At this stage, the region is in clean list and will be mistakenly reclaimed
by rh_update_states() later.

Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
drivers/md/dm-raid1.c