From: Neil Brown <neilb@notabene.brown>
Date: Fri, 27 Jun 2008 22:31:26 +0000 (+1000)
Subject: Close race in md_probe
X-Git-Tag: v2.6.27-rc1~957^2~50
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f48ed538386cb41559282d989354e8f5d442d71c;p=linux-2.6

Close race in md_probe

There is a possible race in md_probe.  If two threads call md_probe
for the same device, then one could exit (having checked that
->gendisk exists) before the other has called kobject_init_and_add,
thus returning an incomplete kobj which will cause problems when
we try to add children to it.

So extend the range of protection of disks_mutex slightly to
avoid this possibility.

Signed-off-by: Neil Brown <neilb@suse.de>
---

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 261322722c..97852099de 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3359,9 +3359,9 @@ static struct kobject *md_probe(dev_t dev, int *part, void *data)
 	disk->queue = mddev->queue;
 	add_disk(disk);
 	mddev->gendisk = disk;
-	mutex_unlock(&disks_mutex);
 	error = kobject_init_and_add(&mddev->kobj, &md_ktype, &disk->dev.kobj,
 				     "%s", "md");
+	mutex_unlock(&disks_mutex);
 	if (error)
 		printk(KERN_WARNING "md: cannot register %s/md - name in use\n",
 		       disk->disk_name);