drbd: fix race between handshake and admin disconnect/down
authorLars Ellenberg <lars.ellenberg@linbit.com>
Tue, 29 Aug 2017 08:20:44 +0000 (10:20 +0200)
committerJens Axboe <axboe@kernel.dk>
Tue, 29 Aug 2017 21:34:46 +0000 (15:34 -0600)
commitcde81d99afa4112eecef3f45129b5827f6ac158e
tree07f4b2a5f05448cda6791ed5ec146ca55e987c09
parent33d32fa7120ed184efc9be1ea3c016109b4fea84
drbd: fix race between handshake and admin disconnect/down

conn_try_disconnect() could potentialy hit the BUG_ON()
in _conn_set_state() where it iterates over _drbd_set_state()
and "asserts" via BUG_ON() that the latter was successful.

If the STATE_SENT bit was not yet visible to conn_is_valid_transition()
early in _conn_request_state(), but became visible before conn_set_state()
later in that call path, we could hit the BUG_ON() after _drbd_set_state(),
because it returned SS_IN_TRANSIENT_STATE.

To avoid that race, we better protect set_bit(SENT_STATE) with the spinlock.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/drbd/drbd_receiver.c