spl-mutex: fix race in mutex_exit

Prevent race on accessing kmutex_t when the mutex is
embedded in a ref counted structure.

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Chunwei Chen <david.chen@osnexus.com>
Signed-off-by: Gvozden Neskovic <neskovic@gmail.com>
Closes zfsonlinux/zfs#6401
Closes #637
This commit is contained in:
Gvozden Neskovic 2017-08-03 05:42:58 +02:00 committed by Brian Behlendorf
parent 549423c0d4
commit 261a3151e1

View File

@ -183,12 +183,13 @@ spl_mutex_lockdep_on_maybe(kmutex_t *mp) \
*/ */
#define mutex_exit(mp) \ #define mutex_exit(mp) \
{ \ { \
spl_mutex_lockdep_off_maybe(mp); \
spin_lock(&(mp)->m_lock); \
spl_mutex_clear_owner(mp); \ spl_mutex_clear_owner(mp); \
spin_lock(&(mp)->m_lock); \
spl_mutex_lockdep_off_maybe(mp); \
mutex_unlock(MUTEX(mp)); \ mutex_unlock(MUTEX(mp)); \
spin_unlock(&(mp)->m_lock); \
spl_mutex_lockdep_on_maybe(mp); \ spl_mutex_lockdep_on_maybe(mp); \
spin_unlock(&(mp)->m_lock); \
/* NOTE: do not dereference mp after this point */ \
} }
int spl_mutex_init(void); int spl_mutex_init(void);