drbd: Fixed a race between disk-attach and unexpected state changes

This was a very hard to trigger race condition.

If we got a state packet from the peer, after drbd_nl_disk() has
already changed the disk state to D_NEGOTIATING but
after_state_ch() was not yet run by the worker, then receive_state()
might called drbd_sync_handshake(), which in turn crashed
when accessing p_uuid.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 632e3245d1bb..2151f18b21de 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -1114,6 +1114,12 @@ static int drbd_nl_disk_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp
                 mdev->new_state_tmp.i = ns.i;
                 ns.i = os.i;
                 ns.disk = D_NEGOTIATING;
+
+                /* We expect to receive up-to-date UUIDs soon.
+                   To avoid a race in receive_state, free p_uuid while
+                   holding req_lock. I.e. atomic with the state change */
+                kfree(mdev->p_uuid);
+                mdev->p_uuid = NULL;
         }
 
         rv = _drbd_set_state(mdev, ns, CS_VERBOSE, NULL);