[dm-devel] [PATCH] 2.6.12-rc6: fix rh_dec()/rh_inc() race in dm-raid1.c

[Jun'ichi Nomura]

Hello,

I revised the patch based on comments from Jon.
Attached patch should work on the version of mark_region which may block.

Thanks,

Jun'ichi Nomura wrote:
> Jonathan E Brassow wrote:
>  > could this be solved by doing your patch in rh_dec and just moving the
>  > atomic_inc in rh_inc?  The reason I ask is that the mark_region log
>  > call can block.
> 
> No.
> Unless they are serialized, it's possible that rh_inc() will see the
> state RH_DIRTY, while rh_dec change it to RH_CLEAN.
> As a result, the region which has I/O in-flight may be freed.
> 
> Is it reasonable to call mark_region() unconditionally?
> Then we can call it outside of the lock.
> 
>  >>    CPU0                                   CPU1
>  >>
>  >> -----------------------------------------------------------------------
>  >> -------
>  >>    rh_dec()
>  >>      if (atomic_dec_and_test(pending))
>  >>         <the region is still marked dirty>
>            if (atomic_read(pending)==0)
>  >>                                           rh_inc()
>  >>                                             atomic_inc(pending)
>  >>                                             if the region is clean
>  >>                                                mark the region dirty
>  >>                                                and remove from clean 
> list
>                                                else do nothing
>  >>         mark the region clean
>  >>         and move to clean list
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dm-raid1-race2.new.patch
Type: text/x-patch
Size: 976 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/dm-devel/attachments/20050627/f656d6cc/attachment.bin>