Fix reference counting race on log buffers
authorDave Chinner <david@fromorbit.com>
Fri, 11 Jul 2008 07:43:55 +0000 (17:43 +1000)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 11 Jul 2008 18:37:18 +0000 (11:37 -0700)
commit49641f1acfdfd437ed9b0a70b86bf36626c02afe
tree628838591b71f80d96c548d1a145b8d086c33c2a
parent61ca9daa2ca3022dc9cb22bd98e69c1b61e412ad
Fix reference counting race on log buffers

When we release the iclog, we do an atomic_dec_and_lock to determine if
we are the last reference and need to trigger update of log headers and
writeout.  However, in xlog_state_get_iclog_space() we also need to
check if we have the last reference count there.  If we do, we release
the log buffer, otherwise we decrement the reference count.

But the compare and decrement in xlog_state_get_iclog_space() is not
atomic, so both places can see a reference count of 2 and neither will
release the iclog.  That leads to a filesystem hang.

Close the race by replacing the atomic_read() and atomic_dec() pair with
atomic_add_unless() to ensure that they are executed atomically.

Signed-off-by: Dave Chinner <david@fromorbit.com>
Reviewed-by: Tim Shimmin <tes@sgi.com>
Tested-by: Eric Sandeen <sandeen@sandeen.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/xfs/xfs_log.c