summaryrefslogtreecommitdiff
path: root/drivers/dax
diff options
context:
space:
mode:
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>2026-09-14 13:36:19 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2026-09-14 13:36:19 +0200
commitb94a3879cf84d98cee119045bee6538659bfc2ce (patch)
tree6ad8bdff7057bc0d27865fc80eecb8b597adc196 /drivers/dax
parent70db9eace66c4932f17d42640fad17f561aa20da (diff)
parent8f3741e6feb045da5b406df0a80b42a1adfb289b (diff)
downloadlinux-stable-linux-rolling-lts.tar.gz
linux-stable-linux-rolling-lts.zip
Merge v6.18.52linux-rolling-lts
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/dax')
-rw-r--r--drivers/dax/super.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index d7714d8afb0f..efa5f6186019 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -232,6 +232,7 @@ EXPORT_SYMBOL_GPL(dax_recovery_write);
int dax_holder_notify_failure(struct dax_device *dax_dev, u64 off,
u64 len, int mf_flags)
{
+ const struct dax_holder_operations *ops;
int rc, id;
id = dax_read_lock();
@@ -240,12 +241,19 @@ int dax_holder_notify_failure(struct dax_device *dax_dev, u64 off,
goto out;
}
- if (!dax_dev->holder_ops) {
+ /*
+ * Read holder_ops once: a concurrent fs_put_dax() can clear it without
+ * synchronizing against readers. Without the single fetch the compiler
+ * could reload between the NULL check and the call and dereference a
+ * NULL ops.
+ */
+ ops = READ_ONCE(dax_dev->holder_ops);
+ if (!ops) {
rc = -EOPNOTSUPP;
goto out;
}
- rc = dax_dev->holder_ops->notify_failure(dax_dev, off, len, mf_flags);
+ rc = ops->notify_failure(dax_dev, off, len, mf_flags);
out:
dax_read_unlock(id);
return rc;