[dm-devel] [PATCH] dm-thin: fix a race in thin_dtr

[Mikulas Patocka]

Note that as long as struct thin_c is in the list, anyone can grab a
reference of it. Consequently, we must wait for the reference count to
drop to zero *after* we remove the structure from the list, not before.

Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>

---
 drivers/md/dm-thin.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Index: linux-3.18-rc3/drivers/md/dm-thin.c
===================================================================
--- linux-3.18-rc3.orig/drivers/md/dm-thin.c	2014-11-05 21:08:06.000000000 +0100
+++ linux-3.18-rc3/drivers/md/dm-thin.c	2014-11-05 21:08:57.000000000 +0100
@@ -3247,14 +3247,14 @@ static void thin_dtr(struct dm_target *t
 	struct thin_c *tc = ti->private;
 	unsigned long flags;
 
-	thin_put(tc);
-	wait_for_completion(&tc->can_destroy);
-
 	spin_lock_irqsave(&tc->pool->lock, flags);
 	list_del_rcu(&tc->list);
 	spin_unlock_irqrestore(&tc->pool->lock, flags);
 	synchronize_rcu();
 
+	thin_put(tc);
+	wait_for_completion(&tc->can_destroy);
+
 	mutex_lock(&dm_thin_pool_table.mutex);
 
 	__pool_dec(tc->pool);