[Devel] [PATCH RHEL7 COMMIT] cbt: fix possible race on alloc_page()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-327.18.2.vz7.14.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.18.2.vz7.14.8
------>
commit a37f82a27694237016ab7c8ae4afbc49ea8f402e
Author: Maxim Patlasov <mpatlasov at virtuozzo.com>
Date:   Fri May 27 13:54:36 2016 +0400

    cbt: fix possible race on alloc_page()
    
    cbt_page_alloc() drops cbt->lock before calling alloc_page(),
    then re-acquires it. It's safer to re-check that cbt->map[idx]
    is still NULL after re-acquiring the lock.
    
    Signed-off-by: Maxim Patlasov <mpatlasov at virtuozzo.com>
    Acked-by: Dmitry Monakhov <dmonakhov at virtuozzo.com>
---
 block/blk-cbt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/block/blk-cbt.c b/block/blk-cbt.c
index d635186..001dbfd 100644
--- a/block/blk-cbt.c
+++ b/block/blk-cbt.c
@@ -128,7 +128,12 @@ static int cbt_page_alloc(struct cbt_info  **cbt_pp, unsigned long idx,
 		spin_unlock_irq(&cbt->lock);
 		return -ENOMEM;
 	}
-	cbt->map[idx] = page;
+
+	if (likely(CBT_PAGE(cbt, idx) == NULL))
+		cbt->map[idx] = page;
+	else
+		__free_page(page);
+
 	page = NULL;
 	spin_unlock_irq(&cbt->lock);