• NeilBrown's avatar
    md: Avoid waking up a thread after it has been freed. · 01f96c0a
    NeilBrown authored
    Two related problems:
    
    1/ some error paths call "md_unregister_thread(mddev->thread)"
       without subsequently clearing ->thread.  A subsequent call
       to mddev_unlock will try to wake the thread, and crash.
    
    2/ Most calls to md_wakeup_thread are protected against the thread
       disappeared either by:
          - holding the ->mutex
          - having an active request, so something else must be keeping
            the array active.
       However mddev_unlock calls md_wakeup_thread after dropping the
       mutex and without any certainty of an active request, so the
       ->thread could theoretically disappear.
       So we need a spinlock to provide some protections.
    
    So change md_unregister_thread to take a pointer to the thread
    pointer, and ensure that it always does the required locking, and
    clears the pointer properly.
    Reported-by: default avatar"Moshe Melnikov" <moshe@zadarastorage.com>
    Signed-off-by: default avatarNeilBrown <neilb@suse.de>
    cc: stable@kernel.org
    01f96c0a
multipath.c 14.1 KB