Fixing gang ABD child removal race condition

On linux the list debug code has been setting off a failure when
checking that the node->next->prev value is pointing back at the node.
At times this check evaluates to 0xdead. When removing a child from a
gang ABD we must acquire the child's abd_mtx to make sure that the
same ABD is not being added to another gang ABD while it is being
removed from a gang ABD. This fixes a race condition when checking
if an ABDs link is already active and part of another gang ABD before
adding it to a gang.

Added additional debug code for the gang ABD in abd_verify() to make
sure each child ABD has active links. Also check to make sure another
gang ABD is not added to a gang ABD.

Reviewed-by: Serapheim Dimitropoulos <[email protected]>
Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Matt Ahrens <[email protected]>
Signed-off-by: Brian Atkinson <[email protected]>
Closes #10511 

1 files changed, 3 insertions, 1 deletions

diff --git a/include/os/linux/spl/sys/list.h b/include/os/linux/spl/sys/list.h
index 74b784e93..be38f328f 100644
--- a/include/os/linux/spl/sys/list.h
+++ b/include/os/linux/spl/sys/list.h
@@ -26,6 +26,7 @@
 #define	_SPL_LIST_H
 
 #include <sys/types.h>
+#include <sys/debug.h>
 #include <linux/list.h>
 
 /*
@@ -184,7 +185,8 @@ list_prev(list_t *list, void *object)
 static inline int
 list_link_active(list_node_t *node)
 {
-	return (node->next != LIST_POISON1) && (node->prev != LIST_POISON2);
+	EQUIV(node->next == LIST_POISON1, node->prev == LIST_POISON2);
+	return (node->next != LIST_POISON1);
 }
 
 static inline void