dm crypt: fix async inc_pending

The pending reference count must be incremented *before* the async work is queued to another thread, not after. Otherwise there's a race if the work completes and decrements the reference count before it gets incremented. Signed-off-by: Milan Broz <mbroz@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com>

dm crypt: fix async inc_pending
The pending reference count must be incremented *before* the async work is queued to another thread, not after. Otherwise there's a race if the work completes and decrements the reference count before it gets incremented. Signed-off-by: Milan Broz <mbroz@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Milan Broz · Alasdair G Kergon
1 parent 6c031f41db
Showing 1 changed file with 2 additions and 3 deletions Side-by-side Diff
drivers/md/dm-crypt.c
@@ -719,16 +719,15 @@
  
 		remaining -= clone->bi_size;
  
+		crypt_inc_pending(io);
 		r = crypt_convert(cc, &io->ctx);
  
 		if (atomic_dec_and_test(&io->ctx.pending)) {
 			/* processed, no running async crypto  */
-			crypt_inc_pending(io);
 			kcryptd_crypt_write_io_submit(io, r, 0);
 			if (unlikely(r < 0))
 				break;
-		} else
-			crypt_inc_pending(io);
+		}
  
 		/* out of memory -> run queues */
 		if (unlikely(remaining)) {
...	...	@@ -719,16 +719,15 @@
719	719
720	720	remaining -= clone->bi_size;
721	721
	722	+ crypt_inc_pending(io);
722	723	r = crypt_convert(cc, &io->ctx);
723	724
724	725	if (atomic_dec_and_test(&io->ctx.pending)) {
725	726	/* processed, no running async crypto */
726		- crypt_inc_pending(io);
727	727	kcryptd_crypt_write_io_submit(io, r, 0);
728	728	if (unlikely(r < 0))
729	729	break;
730		- } else
731		- crypt_inc_pending(io);
	730	+ }
732	731
733	732	/* out of memory -> run queues */
734	733	if (unlikely(remaining)) {