aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/md/dm-ioctl.c
diff options
context:
space:
mode:
authorAlasdair G Kergon <agk@redhat.com>2006-11-08 20:44:42 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2006-11-08 21:29:23 -0500
commitbfc5ecdf48b529f6a2bd98ba26bfac39ca8cd8a5 (patch)
tree4b62c928d685a9badbdcb1a1048479ee9b8594f9 /drivers/md/dm-ioctl.c
parentc06cb8b1c4d25e5b4d7a2d7c2462619de1e0dbc4 (diff)
[PATCH] dm: fix find_device race
There is a race between dev_create() and find_device(). If the mdptr has not yet been stored against a device, find_device() needs to behave as though no device was found. It already returns NULL, but there is a dm_put() missing: it must drop the reference dm_get_md() took. The bug was introduced by dm-fix-mapped-device-ref-counting.patch. It manifests itself if another dm ioctl attempts to reference a newly-created device while the device creation ioctl is still running. The consequence is that the device cannot be removed until the machine is rebooted. Certain udev configurations can lead to this happening. Signed-off-by: Alasdair G Kergon <agk@redhat.com> Cc: <dm-devel@redhat.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/md/dm-ioctl.c')
-rw-r--r--drivers/md/dm-ioctl.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index d13bb15a8a02..4510ad8f971c 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -606,9 +606,14 @@ static struct hash_cell *__find_device_hash_cell(struct dm_ioctl *param)
606 return __get_name_cell(param->name); 606 return __get_name_cell(param->name);
607 607
608 md = dm_get_md(huge_decode_dev(param->dev)); 608 md = dm_get_md(huge_decode_dev(param->dev));
609 if (md) 609 if (!md)
610 mdptr = dm_get_mdptr(md); 610 goto out;
611 611
612 mdptr = dm_get_mdptr(md);
613 if (!mdptr)
614 dm_put(md);
615
616out:
612 return mdptr; 617 return mdptr;
613} 618}
614 619