md: raid5: fix clearing of biofill operations

ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the
'pending' and 'ack' bits.  Since the test_and_ack_op() macro only checks
against 'complete' it can get an inconsistent snapshot of pending work.

Move the clearing of these bits to handle_stripe5(), under the lock.

Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Tested-by: Joel Bertrand <joel.bertrand@systella.fr>
Signed-off-by: Neil Brown <neilb@suse.de>
Cc: Stable <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 14 insertions, 3 deletions

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 8ee181a01f52..80a67d789b72 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -376,7 +376,12 @@ static unsigned long get_stripe_work(struct stripe_head *sh)
                 ack++;
 
         sh->ops.count -= ack;
-        BUG_ON(sh->ops.count < 0);
+        if (unlikely(sh->ops.count < 0)) {
+                printk(KERN_ERR "pending: %#lx ops.pending: %#lx ops.ack: %#lx "
+                        "ops.complete: %#lx\n", pending, sh->ops.pending,
+                        sh->ops.ack, sh->ops.complete);
+                BUG();
+        }
 
         return pending;
 }
@@ -550,8 +555,7 @@ static void ops_complete_biofill(void *stripe_head_ref)
                         }
                 }
         }
-        clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
-        clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
+        set_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
 
         return_io(return_bi);
 
@@ -2893,6 +2897,13 @@ static void handle_stripe6(struct stripe_head *sh, struct page *tmp_page)
         s.expanded = test_bit(STRIPE_EXPAND_READY, &sh->state);
         /* Now to look around and see what can be done */
 
+        /* clean-up completed biofill operations */
+        if (test_bit(STRIPE_OP_BIOFILL, &sh->ops.complete)) {
+                clear_bit(STRIPE_OP_BIOFILL, &sh->ops.pending);
+                clear_bit(STRIPE_OP_BIOFILL, &sh->ops.ack);
+                clear_bit(STRIPE_OP_BIOFILL, &sh->ops.complete);
+        }
+
         rcu_read_lock();
         for (i=disks; i--; ) {
                 mdk_rdev_t *rdev;