From e5129fbd6ed0a780b111bf84bbe8e5ba86af1f29 Mon Sep 17 00:00:00 2001 From: Lipeng Sang Date: Mon, 20 Mar 2023 15:57:33 +0800 Subject: [PATCH] md: Flush workqueue md_rdev_misc_wq in md_alloc() stable inclusion from stable-v5.19.17 commit 5e8daf906f890560df430d30617c692a794acb73 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6OERX CVE: NA Reference: https://github.com/torvalds/linux/commit/5e8daf906f890560df430d30617c692a794acb73 ---------------------------------------------------------------------- A race condition still exists when removing and re-creating md devices in test cases. However, it is only seen on some setups. The race condition was tracked down to a reference still being held to the kobject by the rdev in the md_rdev_misc_wq which will be released in rdev_delayed_delete(). md_alloc() waits for previous deletions by waiting on the md_misc_wq, but the md_rdev_misc_wq may still be holding a reference to a recently removed device. To fix this, also flush the md_rdev_misc_wq in md_alloc(). Signed-off-by: David Sloan [logang@deltatee.com: rewrote commit message] Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Lipeng Sang --- drivers/md/md.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/md/md.c b/drivers/md/md.c index e072ccb08735..9013a1bbd10b 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -5690,6 +5690,7 @@ static int md_alloc(dev_t dev, char *name) * completely removed (mddev_delayed_delete). */ flush_workqueue(md_misc_wq); + flush_workqueue(md_rdev_misc_wq); mutex_lock(&disks_mutex); error = -EEXIST; -- Gitee