md/raid5-cache: Take mddev_lock in r5c_journal_mode_show()

The mddev->lock spinlock doesn't protect against the removal of
conf->log in r5l_exit_log() so conf->log may be freed before it
is used.

To fix this, take the mddev_lock() insteaad of the mddev->lock spinlock.

Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 6f2dd73128b0715172b28b0fef257c2425ca97c7..4da88888fbfc20104de993e435dd81f0903706f4 100644 (file)
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -2534,12 +2534,13 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
        struct r5conf *conf;
        int ret;
 
-       spin_lock(&mddev->lock);
+       ret = mddev_lock(mddev);
+       if (ret)
+               return ret;
+
        conf = mddev->private;
-       if (!conf || !conf->log) {
-               spin_unlock(&mddev->lock);
-               return 0;
-       }
+       if (!conf || !conf->log)
+               goto out_unlock;
 
        switch (conf->log->r5c_journal_mode) {
        case R5C_JOURNAL_MODE_WRITE_THROUGH:
@@ -2557,7 +2558,9 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
        default:
                ret = 0;
        }
-       spin_unlock(&mddev->lock);
+
+out_unlock:
+       mddev_unlock(mddev);
        return ret;
 }