Commit 78ede6a0 authored by Logan Gunthorpe's avatar Logan Gunthorpe Committed by Jens Axboe
Browse files

md/raid5-cache: Take mddev_lock in r5c_journal_mode_show() 



The mddev->lock spinlock doesn't protect against the removal of
conf->log in r5l_exit_log() so conf->log may be freed before it
is used.

To fix this, take the mddev_lock() insteaad of the mddev->lock spinlock.

Signed-off-by: default avatarLogan Gunthorpe <logang@deltatee.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarSong Liu <song@kernel.org>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent c629f345

drivers/md/raid5-cache.c

+9 −6
Original line number Diff line number Diff line
@@ -2534,12 +2534,13 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page) 
	struct r5conf *conf;

	int ret;



	spin_lock(&mddev->lock);

	ret = mddev_lock(mddev);

	if (ret)

		return ret;



	conf = mddev->private;

	if (!conf || !conf->log) {

		spin_unlock(&mddev->lock);

		return 0;

	}

	if (!conf || !conf->log)

		goto out_unlock;



	switch (conf->log->r5c_journal_mode) {

	case R5C_JOURNAL_MODE_WRITE_THROUGH:
@@ -2557,7 +2558,9 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page) 
	default:

		ret = 0;

	}

	spin_unlock(&mddev->lock);



out_unlock:

	mddev_unlock(mddev);

	return ret;

}