In aoecmd_sleepwork, there is a race condition caused by two consecutive
writes to the 'flags' variable within a critical section. If a read
operation occurs between these writes, an intermediate state may be
read, potentially causing bugs.
To address this issue, the 'flags' variable should be updated in a
single operation to ensure atomicity and prevent any intermediate state
from being read.
Fixes: 3ae1c24e395b ("[PATCH] aoe [2/8]: support dynamic resizing of AoE devices")
Signed-off-by: Gui-Dong Han <hanguidong02@xxxxxxxxxxx>
---
drivers/block/aoe/aoecmd.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index cc9077b588d7..37d556f019c0 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -897,8 +897,7 @@ aoecmd_sleepwork(struct work_struct *work)
set_capacity_and_notify(d->gd, d->ssize);
spin_lock_irq(&d->lock);
- d->flags |= DEVFL_UP;
- d->flags &= ~DEVFL_NEWSIZE;
+ d->flags = (d->flags | DEVFL_UP) & ~DEVFL_NEWSIZE;
spin_unlock_irq(&d->lock);
}
}
--
2.34.1
