Ocfs2 devel - Aug 2014 - [patch 08/10] ocfs2/dlm: fix race between dispatched_work and dlm_lockres_grab_inflight_worker

From: Joseph Qi <joseph.qi at huawei.com>
Subject: ocfs2/dlm: fix race between dispatched_work and
dlm_lockres_grab_inflight_worker

ac4fef4d23ed ("ocfs2/dlm: do not purge lockres that is queued for assert
master") may have the following possible race case:

dlm_dispatch_assert_master       dlm_wq
=======================================================================queue_work(dlm->quedlm_worker,
	&dlm->dispatched_work);
                                 dispatch work,
				 dlm_lockres_drop_inflight_worker
				 *BUG_ON(res->inflight_assert_workers == 0)*
dlm_lockres_grab_inflight_worker
inflight_assert_workers++

So ensure inflight_assert_workers to be increased first.

Signed-off-by: Joseph Qi <joseph.qi at huawei.com>
Signed-off-by: Xue jiufei <xuejiufei at huawei.com>
Cc: Joel Becker <jlbec at evilplan.org>
Cc: Mark Fasheh <mfasheh at suse.com>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
---

 fs/ocfs2/dlm/dlmmaster.c |   12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff -puN
fs/ocfs2/dlm/dlmmaster.c~ocfs2-dlm-fix-race-between-dispatched_work-and-dlm_lockres_grab_inflight_worker
fs/ocfs2/dlm/dlmmaster.c
---
a/fs/ocfs2/dlm/dlmmaster.c~ocfs2-dlm-fix-race-between-dispatched_work-and-dlm_lockres_grab_inflight_worker
+++ a/fs/ocfs2/dlm/dlmmaster.c
@@ -684,14 +684,6 @@ void __dlm_lockres_grab_inflight_worker(
 			res->inflight_assert_workers);
 }
 
-static void dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
-		struct dlm_lock_resource *res)
-{
-	spin_lock(&res->spinlock);
-	__dlm_lockres_grab_inflight_worker(dlm, res);
-	spin_unlock(&res->spinlock);
-}
-
 static void __dlm_lockres_drop_inflight_worker(struct dlm_ctxt *dlm,
 		struct dlm_lock_resource *res)
 {
@@ -1625,6 +1617,7 @@ send_response:
 		}
 		mlog(0, "%u is the owner of %.*s, cleaning everyone else\n",
 			     dlm->node_num, res->lockname.len, res->lockname.name);
+		spin_lock(&res->spinlock);
 		ret = dlm_dispatch_assert_master(dlm, res, 0, request->node_idx,
 						 DLM_ASSERT_MASTER_MLE_CLEANUP);
 		if (ret < 0) {
@@ -1632,7 +1625,8 @@ send_response:
 			response = DLM_MASTER_RESP_ERROR;
 			dlm_lockres_put(res);
 		} else
-			dlm_lockres_grab_inflight_worker(dlm, res);
+			__dlm_lockres_grab_inflight_worker(dlm, res);
+		spin_unlock(&res->spinlock);
 	} else {
 		if (res)
 			dlm_lockres_put(res);
_