• Dave Chinner's avatar
    Fix reference counting race on log buffers · 49641f1a
    Dave Chinner authored
    When we release the iclog, we do an atomic_dec_and_lock to determine if
    we are the last reference and need to trigger update of log headers and
    writeout.  However, in xlog_state_get_iclog_space() we also need to
    check if we have the last reference count there.  If we do, we release
    the log buffer, otherwise we decrement the reference count.
    
    But the compare and decrement in xlog_state_get_iclog_space() is not
    atomic, so both places can see a reference count of 2 and neither will
    release the iclog.  That leads to a filesystem hang.
    
    Close the race by replacing the atomic_read() and atomic_dec() pair with
    atomic_add_unless() to ensure that they are executed atomically.
    Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
    Reviewed-by: default avatarTim Shimmin <tes@sgi.com>
    Tested-by: default avatarEric Sandeen <sandeen@sandeen.net>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    49641f1a
xfs_log.c 105 KB