aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDave Chinner <david@fromorbit.com>2008-07-11 03:43:55 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-07-11 14:37:18 -0400
commit49641f1acfdfd437ed9b0a70b86bf36626c02afe (patch)
tree628838591b71f80d96c548d1a145b8d086c33c2a
parent61ca9daa2ca3022dc9cb22bd98e69c1b61e412ad (diff)
Fix reference counting race on log buffers
When we release the iclog, we do an atomic_dec_and_lock to determine if we are the last reference and need to trigger update of log headers and writeout. However, in xlog_state_get_iclog_space() we also need to check if we have the last reference count there. If we do, we release the log buffer, otherwise we decrement the reference count. But the compare and decrement in xlog_state_get_iclog_space() is not atomic, so both places can see a reference count of 2 and neither will release the iclog. That leads to a filesystem hang. Close the race by replacing the atomic_read() and atomic_dec() pair with atomic_add_unless() to ensure that they are executed atomically. Signed-off-by: Dave Chinner <david@fromorbit.com> Reviewed-by: Tim Shimmin <tes@sgi.com> Tested-by: Eric Sandeen <sandeen@sandeen.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--fs/xfs/xfs_log.c15
1 files changed, 11 insertions, 4 deletions
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index afaee301b0ee..ad3d26ddfe31 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -2427,13 +2427,20 @@ restart:
2427 if (iclog->ic_size - iclog->ic_offset < 2*sizeof(xlog_op_header_t)) { 2427 if (iclog->ic_size - iclog->ic_offset < 2*sizeof(xlog_op_header_t)) {
2428 xlog_state_switch_iclogs(log, iclog, iclog->ic_size); 2428 xlog_state_switch_iclogs(log, iclog, iclog->ic_size);
2429 2429
2430 /* If I'm the only one writing to this iclog, sync it to disk */ 2430 /*
2431 if (atomic_read(&iclog->ic_refcnt) == 1) { 2431 * If I'm the only one writing to this iclog, sync it to disk.
2432 * We need to do an atomic compare and decrement here to avoid
2433 * racing with concurrent atomic_dec_and_lock() calls in
2434 * xlog_state_release_iclog() when there is more than one
2435 * reference to the iclog.
2436 */
2437 if (!atomic_add_unless(&iclog->ic_refcnt, -1, 1)) {
2438 /* we are the only one */
2432 spin_unlock(&log->l_icloglock); 2439 spin_unlock(&log->l_icloglock);
2433 if ((error = xlog_state_release_iclog(log, iclog))) 2440 error = xlog_state_release_iclog(log, iclog);
2441 if (error)
2434 return error; 2442 return error;
2435 } else { 2443 } else {
2436 atomic_dec(&iclog->ic_refcnt);
2437 spin_unlock(&log->l_icloglock); 2444 spin_unlock(&log->l_icloglock);
2438 } 2445 }
2439 goto restart; 2446 goto restart;