aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNeilBrown <[email protected]>2016-12-05 16:40:50 +1100
committerShaohua Li <[email protected]>2016-12-05 17:11:03 -0800
commite2342ca832726a840ca6bd196dd2cc073815b08a (patch)
tree580eb7ef4129964a221c3e802700cf259c0b8dce
parent3d7e7e1d9db048bc6c1503bca9c82193450fc476 (diff)
md: fix refcount problem on mddev when stopping array.
md_open() gets a counted reference on an mddev using mddev_find(). If it ends up returning an error, it must drop this reference. There are two error paths where the reference is not dropped. One only happens if the process is signalled and an awkward time, which is quite unlikely. The other was introduced recently in commit af8d8e6f0. Change the code to ensure the drop the reference when returning an error, and make it harded to re-introduce this sort of bug in the future. Reported-by: Marc Smith <[email protected]> Fixes: af8d8e6f0315 ("md: changes for MD_STILL_CLOSED flag") Signed-off-by: NeilBrown <[email protected]> Acked-by: Guoqing Jiang <[email protected]> Signed-off-by: Shaohua Li <[email protected]>
-rw-r--r--drivers/md/md.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c7894fbbd8e5..84dc8913d13b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7112,7 +7112,8 @@ static int md_open(struct block_device *bdev, fmode_t mode)
if (test_bit(MD_CLOSING, &mddev->flags)) {
mutex_unlock(&mddev->open_mutex);
- return -ENODEV;
+ err = -ENODEV;
+ goto out;
}
err = 0;
@@ -7121,6 +7122,8 @@ static int md_open(struct block_device *bdev, fmode_t mode)
check_disk_change(bdev);
out:
+ if (err)
+ mddev_put(mddev);
return err;
}