aboutsummaryrefslogtreecommitdiffstats
path: root/net/sunrpc
diff options
context:
space:
mode:
authorTrond Myklebust <Trond.Myklebust@netapp.com>2006-03-14 00:20:48 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2006-03-14 10:57:18 -0500
commite6d83d55698b73b4d5d55d3d7715a4c26030d577 (patch)
treeb2c0e3a799444d9c25c00cf34975b456e0c9ef9d /net/sunrpc
parentc12e87f4652b1ba3be168b4f63a440399b941928 (diff)
[PATCH] SUNRPC: Fix potential deadlock in RPC code
In rpc_wake_up() and rpc_wake_up_status(), it is possible for the call to __rpc_wake_up_task() to fail if another thread happens to be calling rpc_wake_up_task() on the same rpc_task. Problem noticed by Bruno Faccini. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'net/sunrpc')
-rw-r--r--net/sunrpc/sched.c13
1 files changed, 5 insertions, 8 deletions
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 802d4fe0f55c..e838d042f7f5 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -515,16 +515,14 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
515 */ 515 */
516void rpc_wake_up(struct rpc_wait_queue *queue) 516void rpc_wake_up(struct rpc_wait_queue *queue)
517{ 517{
518 struct rpc_task *task; 518 struct rpc_task *task, *next;
519
520 struct list_head *head; 519 struct list_head *head;
520
521 spin_lock_bh(&queue->lock); 521 spin_lock_bh(&queue->lock);
522 head = &queue->tasks[queue->maxpriority]; 522 head = &queue->tasks[queue->maxpriority];
523 for (;;) { 523 for (;;) {
524 while (!list_empty(head)) { 524 list_for_each_entry_safe(task, next, head, u.tk_wait.list)
525 task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
526 __rpc_wake_up_task(task); 525 __rpc_wake_up_task(task);
527 }
528 if (head == &queue->tasks[0]) 526 if (head == &queue->tasks[0])
529 break; 527 break;
530 head--; 528 head--;
@@ -541,14 +539,13 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
541 */ 539 */
542void rpc_wake_up_status(struct rpc_wait_queue *queue, int status) 540void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
543{ 541{
542 struct rpc_task *task, *next;
544 struct list_head *head; 543 struct list_head *head;
545 struct rpc_task *task;
546 544
547 spin_lock_bh(&queue->lock); 545 spin_lock_bh(&queue->lock);
548 head = &queue->tasks[queue->maxpriority]; 546 head = &queue->tasks[queue->maxpriority];
549 for (;;) { 547 for (;;) {
550 while (!list_empty(head)) { 548 list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
551 task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
552 task->tk_status = status; 549 task->tk_status = status;
553 __rpc_wake_up_task(task); 550 __rpc_wake_up_task(task);
554 } 551 }