diff options
author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2006-03-14 00:20:48 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-03-14 10:57:18 -0500 |
commit | e6d83d55698b73b4d5d55d3d7715a4c26030d577 (patch) | |
tree | b2c0e3a799444d9c25c00cf34975b456e0c9ef9d /net/sunrpc | |
parent | c12e87f4652b1ba3be168b4f63a440399b941928 (diff) |
[PATCH] SUNRPC: Fix potential deadlock in RPC code
In rpc_wake_up() and rpc_wake_up_status(), it is possible for the call to
__rpc_wake_up_task() to fail if another thread happens to be calling
rpc_wake_up_task() on the same rpc_task.
Problem noticed by Bruno Faccini.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/sunrpc')
-rw-r--r-- | net/sunrpc/sched.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c index 802d4fe0f55c..e838d042f7f5 100644 --- a/net/sunrpc/sched.c +++ b/net/sunrpc/sched.c | |||
@@ -515,16 +515,14 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue) | |||
515 | */ | 515 | */ |
516 | void rpc_wake_up(struct rpc_wait_queue *queue) | 516 | void rpc_wake_up(struct rpc_wait_queue *queue) |
517 | { | 517 | { |
518 | struct rpc_task *task; | 518 | struct rpc_task *task, *next; |
519 | |||
520 | struct list_head *head; | 519 | struct list_head *head; |
520 | |||
521 | spin_lock_bh(&queue->lock); | 521 | spin_lock_bh(&queue->lock); |
522 | head = &queue->tasks[queue->maxpriority]; | 522 | head = &queue->tasks[queue->maxpriority]; |
523 | for (;;) { | 523 | for (;;) { |
524 | while (!list_empty(head)) { | 524 | list_for_each_entry_safe(task, next, head, u.tk_wait.list) |
525 | task = list_entry(head->next, struct rpc_task, u.tk_wait.list); | ||
526 | __rpc_wake_up_task(task); | 525 | __rpc_wake_up_task(task); |
527 | } | ||
528 | if (head == &queue->tasks[0]) | 526 | if (head == &queue->tasks[0]) |
529 | break; | 527 | break; |
530 | head--; | 528 | head--; |
@@ -541,14 +539,13 @@ void rpc_wake_up(struct rpc_wait_queue *queue) | |||
541 | */ | 539 | */ |
542 | void rpc_wake_up_status(struct rpc_wait_queue *queue, int status) | 540 | void rpc_wake_up_status(struct rpc_wait_queue *queue, int status) |
543 | { | 541 | { |
542 | struct rpc_task *task, *next; | ||
544 | struct list_head *head; | 543 | struct list_head *head; |
545 | struct rpc_task *task; | ||
546 | 544 | ||
547 | spin_lock_bh(&queue->lock); | 545 | spin_lock_bh(&queue->lock); |
548 | head = &queue->tasks[queue->maxpriority]; | 546 | head = &queue->tasks[queue->maxpriority]; |
549 | for (;;) { | 547 | for (;;) { |
550 | while (!list_empty(head)) { | 548 | list_for_each_entry_safe(task, next, head, u.tk_wait.list) { |
551 | task = list_entry(head->next, struct rpc_task, u.tk_wait.list); | ||
552 | task->tk_status = status; | 549 | task->tk_status = status; |
553 | __rpc_wake_up_task(task); | 550 | __rpc_wake_up_task(task); |
554 | } | 551 | } |