md: Avoid waking up a thread after it has been freed.
authorNeilBrown <neilb@suse.de>
Wed, 21 Sep 2011 05:30:20 +0000 (15:30 +1000)
committerNeilBrown <neilb@suse.de>
Wed, 21 Sep 2011 05:30:20 +0000 (15:30 +1000)
commit01f96c0a9922cd9919baf9d16febdf7016177a12
treea877fe509c4ef0db5252b7192df56009c1d06d6f
parent27a7b260f71439c40546b43588448faac01adb93
md: Avoid waking up a thread after it has been freed.

Two related problems:

1/ some error paths call "md_unregister_thread(mddev->thread)"
   without subsequently clearing ->thread.  A subsequent call
   to mddev_unlock will try to wake the thread, and crash.

2/ Most calls to md_wakeup_thread are protected against the thread
   disappeared either by:
      - holding the ->mutex
      - having an active request, so something else must be keeping
        the array active.
   However mddev_unlock calls md_wakeup_thread after dropping the
   mutex and without any certainty of an active request, so the
   ->thread could theoretically disappear.
   So we need a spinlock to provide some protections.

So change md_unregister_thread to take a pointer to the thread
pointer, and ensure that it always does the required locking, and
clears the pointer properly.

Reported-by: "Moshe Melnikov" <moshe@zadarastorage.com>
Signed-off-by: NeilBrown <neilb@suse.de>
cc: stable@kernel.org
drivers/md/md.c
drivers/md/md.h
drivers/md/multipath.c
drivers/md/raid1.c
drivers/md/raid10.c
drivers/md/raid5.c