Note that as long as struct thin_c is in the list, anyone can grab a reference of it. Consequently, we must wait for the reference count to drop to zero *after* we remove the structure from the list, not before. Signed-off-by: Mikulas Patocka <mpatocka@xxxxxxxxxx> --- drivers/md/dm-thin.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Index: linux-3.18-rc3/drivers/md/dm-thin.c =================================================================== --- linux-3.18-rc3.orig/drivers/md/dm-thin.c 2014-11-05 21:08:06.000000000 +0100 +++ linux-3.18-rc3/drivers/md/dm-thin.c 2014-11-05 21:08:57.000000000 +0100 @@ -3247,14 +3247,14 @@ static void thin_dtr(struct dm_target *t struct thin_c *tc = ti->private; unsigned long flags; - thin_put(tc); - wait_for_completion(&tc->can_destroy); - spin_lock_irqsave(&tc->pool->lock, flags); list_del_rcu(&tc->list); spin_unlock_irqrestore(&tc->pool->lock, flags); synchronize_rcu(); + thin_put(tc); + wait_for_completion(&tc->can_destroy); + mutex_lock(&dm_thin_pool_table.mutex); __pool_dec(tc->pool); -- dm-devel mailing list dm-devel@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/dm-devel
