drbd_disconnect: grab meta.socket mutex as well

Fixes a race and potential kernel panic if e.g. the worker was just
about to send a few P_RS_IS_IN_SYNC via the meta socket for checksum
based resync, while the receiver destroys the sockets in
drbd_disconnect.

To make sure no-one is using the meta socket,
it is not enough to stop the asender...
Grab the meta socket mutex before destroying it.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index b2d347d18c7d40b5b1b694e782d93d4968ea8126..67e0fc5422497f269bb8ccb9ab1ae24c12db6a09 100644 (file)
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -3173,14 +3173,18 @@ void drbd_free_bc(struct drbd_backing_dev *ldev)
 void drbd_free_sock(struct drbd_conf *mdev)
 {
        if (mdev->data.socket) {
+               mutex_lock(&mdev->data.mutex);
                kernel_sock_shutdown(mdev->data.socket, SHUT_RDWR);
                sock_release(mdev->data.socket);
                mdev->data.socket = NULL;
+               mutex_unlock(&mdev->data.mutex);
        }
        if (mdev->meta.socket) {
+               mutex_lock(&mdev->meta.mutex);
                kernel_sock_shutdown(mdev->meta.socket, SHUT_RDWR);
                sock_release(mdev->meta.socket);
                mdev->meta.socket = NULL;
+               mutex_unlock(&mdev->meta.mutex);
        }
 }
 

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 41f36a9cd407b919dd0b84d6eb444827f759d5c8..d803e6c257e2f70da9549405d24f6758be2caa06 100644 (file)
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -3617,10 +3617,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
 
        /* asender does not clean up anything. it must not interfere, either */
        drbd_thread_stop(&mdev->asender);
-
-       mutex_lock(&mdev->data.mutex);
        drbd_free_sock(mdev);
-       mutex_unlock(&mdev->data.mutex);
 
        spin_lock_irq(&mdev->req_lock);
        _drbd_wait_ee_list_empty(mdev, &mdev->active_ee);