aboutsummaryrefslogtreecommitdiff
path: root/drivers/md/dm-thin.c
diff options
context:
space:
mode:
authorMikulas Patocka <mpatocka@redhat.com>2014-11-05 17:00:13 -0500
committerMike Snitzer <snitzer@redhat.com>2014-11-12 20:15:04 -0500
commit17181fb7a0c3a279196c0eeb2caba65a1519614b (patch)
treee8f9d8b7b2134f55e75fca41b9d4fa0165e2f088 /drivers/md/dm-thin.c
parentd1d9220cbaeecce910f3ecfeb71cc897a678eb68 (diff)
downloadlinux-17181fb7a0c3a279196c0eeb2caba65a1519614b.tar.gz
dm thin: fix a race in thin_dtr
As long as struct thin_c is in the list, anyone can grab a reference of it. Consequently, we must wait for the reference count to drop to zero *after* we remove the structure from the list, not before. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Diffstat (limited to 'drivers/md/dm-thin.c')
-rw-r--r--drivers/md/dm-thin.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 8c5504c0e894..767417a28b6f 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -3622,14 +3622,14 @@ static void thin_dtr(struct dm_target *ti)
struct thin_c *tc = ti->private;
unsigned long flags;
- thin_put(tc);
- wait_for_completion(&tc->can_destroy);
-
spin_lock_irqsave(&tc->pool->lock, flags);
list_del_rcu(&tc->list);
spin_unlock_irqrestore(&tc->pool->lock, flags);
synchronize_rcu();
+ thin_put(tc);
+ wait_for_completion(&tc->can_destroy);
+
mutex_lock(&dm_thin_pool_table.mutex);
__pool_dec(tc->pool);