Fixed potential race condition in event group timer

1 files changed, 19 insertions, 10 deletions

diff --git a/litmus/event_group.c b/litmus/event_group.c
index 365ec1ee3651..4a54881fb256 100644
--- a/litmus/event_group.c
+++ b/litmus/event_group.c
@@ -29,34 +29,43 @@ static unsigned int time2slot(lt_t time)
  */
 static enum hrtimer_restart on_timer(struct hrtimer *timer)
 {
-        unsigned long flags;
         unsigned long num = 0;
         struct event_list *el;
         struct rt_event *e;
-        struct list_head *pos, safe, events;
+        struct list_head *pos, events;
 
         el = container_of(timer, struct event_list, timer);
 
-        raw_spin_lock_irqsave(&el->group->queue_lock, flags);
+        raw_spin_lock(&el->group->queue_lock);
+
+        /* Remove event_list from hashtable so no more events
+         * are added to it.
+         */
         VTRACE("Removing event list 0x%p\n", el);
         list_del_init(&el->queue_node);
-        raw_spin_unlock_irqrestore(&el->group->queue_lock, flags);
 
-        /* Empty event list so this event can be requeued */
+        /* Empty event list so that it can be re-used as soon
+         * as the lock is released.
+         */
         VTRACE("Emptying event list 0x%p\n", el);
         list_replace_init(&el->events, &events);
 
         /* Fire events */
-        for (pos = events.next; prefetch(pos->next), pos != &events;) {
-                num++;
+        for (pos = events.next; prefetch(pos->next), events.next != &events;
+             pos = events.next, num++) {
+
                 e = list_entry(pos, struct rt_event, events_node);
+                list_del_init(pos);
+                raw_spin_unlock(&el->group->queue_lock);
+
                 VTRACE("Dequeueing event 0x%p with prio %d from 0x%p\n",
                       e, e->prio, el);
-                list_replace(pos, &safe);
-                list_del_init(pos);
+
                 e->function(e);
-                pos = safe.next;
+
+                raw_spin_lock(&el->group->queue_lock);
         }
+        raw_spin_unlock(&el->group->queue_lock);
         VTRACE("Exhausted %d events from list 0x%p\n", num, el);
         /* sched_trace_action(NULL, num); */
         return HRTIMER_NORESTART;