1 files changed, 85 insertions, 52 deletions

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 225e6510b523..79bc4cdf5d48 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -266,12 +266,28 @@ static int rpc_wait_bit_interruptible(void *word)
         return 0;
 }
 
+static void rpc_set_active(struct rpc_task *task)
+{
+        if (test_and_set_bit(RPC_TASK_ACTIVE, &task->tk_runstate) != 0)
+                return;
+        spin_lock(&rpc_sched_lock);
+#ifdef RPC_DEBUG
+        task->tk_magic = RPC_TASK_MAGIC_ID;
+        task->tk_pid = rpc_task_id++;
+#endif
+        /* Add to global list of all tasks */
+        list_add_tail(&task->tk_task, &all_tasks);
+        spin_unlock(&rpc_sched_lock);
+}
+
 /*
  * Mark an RPC call as having completed by clearing the 'active' bit
  */
-static inline void rpc_mark_complete_task(struct rpc_task *task)
+static void rpc_mark_complete_task(struct rpc_task *task)
 {
-        rpc_clear_active(task);
+        smp_mb__before_clear_bit();
+        clear_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
+        smp_mb__after_clear_bit();
         wake_up_bit(&task->tk_runstate, RPC_TASK_ACTIVE);
 }
 
@@ -295,13 +311,15 @@ EXPORT_SYMBOL(__rpc_wait_for_completion_task);
  */
 static void rpc_make_runnable(struct rpc_task *task)
 {
-        int do_ret;
-
         BUG_ON(task->tk_timeout_fn);
-        do_ret = rpc_test_and_set_running(task);
         rpc_clear_queued(task);
-        if (do_ret)
+        if (rpc_test_and_set_running(task))
                 return;
+        /* We might have raced */
+        if (RPC_IS_QUEUED(task)) {
+                rpc_clear_running(task);
+                return;
+        }
         if (RPC_IS_ASYNC(task)) {
                 int status;
 
@@ -333,9 +351,6 @@ static void __rpc_sleep_on(struct rpc_wait_queue *q, struct rpc_task *task,
                 return;
         }
 
-        /* Mark the task as being activated if so needed */
-        rpc_set_active(task);
-
         __rpc_add_wait_queue(q, task);
 
         BUG_ON(task->tk_callback != NULL);
@@ -346,6 +361,9 @@ static void __rpc_sleep_on(struct rpc_wait_queue *q, struct rpc_task *task,
 void rpc_sleep_on(struct rpc_wait_queue *q, struct rpc_task *task,
                                 rpc_action action, rpc_action timer)
 {
+        /* Mark the task as being activated if so needed */
+        rpc_set_active(task);
+
         /*
          * Protect the queue operations.
          */
@@ -409,16 +427,19 @@ __rpc_default_timer(struct rpc_task *task)
  */
 void rpc_wake_up_task(struct rpc_task *task)
 {
+        rcu_read_lock_bh();
         if (rpc_start_wakeup(task)) {
                 if (RPC_IS_QUEUED(task)) {
                         struct rpc_wait_queue *queue = task->u.tk_wait.rpc_waitq;
 
-                        spin_lock_bh(&queue->lock);
+                        /* Note: we're already in a bh-safe context */
+                        spin_lock(&queue->lock);
                         __rpc_do_wake_up_task(task);
-                        spin_unlock_bh(&queue->lock);
+                        spin_unlock(&queue->lock);
                 }
                 rpc_finish_wakeup(task);
         }
+        rcu_read_unlock_bh();
 }
 
 /*
@@ -481,14 +502,16 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
         struct rpc_task *task = NULL;
 
         dprintk("RPC:      wake_up_next(%p \"%s\")\n", queue, rpc_qname(queue));
-        spin_lock_bh(&queue->lock);
+        rcu_read_lock_bh();
+        spin_lock(&queue->lock);
         if (RPC_IS_PRIORITY(queue))
                 task = __rpc_wake_up_next_priority(queue);
         else {
                 task_for_first(task, &queue->tasks[0])
                         __rpc_wake_up_task(task);
         }
-        spin_unlock_bh(&queue->lock);
+        spin_unlock(&queue->lock);
+        rcu_read_unlock_bh();
 
         return task;
 }
@@ -504,7 +527,8 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
         struct rpc_task *task, *next;
         struct list_head *head;
 
-        spin_lock_bh(&queue->lock);
+        rcu_read_lock_bh();
+        spin_lock(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
                 list_for_each_entry_safe(task, next, head, u.tk_wait.list)
@@ -513,7 +537,8 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
                         break;
                 head--;
         }
-        spin_unlock_bh(&queue->lock);
+        spin_unlock(&queue->lock);
+        rcu_read_unlock_bh();
 }
 
 /**
@@ -528,7 +553,8 @@ void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
         struct rpc_task *task, *next;
         struct list_head *head;
 
-        spin_lock_bh(&queue->lock);
+        rcu_read_lock_bh();
+        spin_lock(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
                 list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
@@ -539,7 +565,8 @@ void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
                         break;
                 head--;
         }
-        spin_unlock_bh(&queue->lock);
+        spin_unlock(&queue->lock);
+        rcu_read_unlock_bh();
 }
 
 static void __rpc_atrun(struct rpc_task *task)
@@ -561,7 +588,9 @@ void rpc_delay(struct rpc_task *task, unsigned long delay)
  */
 static void rpc_prepare_task(struct rpc_task *task)
 {
+        lock_kernel();
         task->tk_ops->rpc_call_prepare(task, task->tk_calldata);
+        unlock_kernel();
 }
 
 /*
@@ -571,7 +600,9 @@ void rpc_exit_task(struct rpc_task *task)
 {
         task->tk_action = NULL;
         if (task->tk_ops->rpc_call_done != NULL) {
+                lock_kernel();
                 task->tk_ops->rpc_call_done(task, task->tk_calldata);
+                unlock_kernel();
                 if (task->tk_action != NULL) {
                         WARN_ON(RPC_ASSASSINATED(task));
                         /* Always release the RPC slot and buffer memory */
@@ -581,6 +612,15 @@ void rpc_exit_task(struct rpc_task *task)
 }
 EXPORT_SYMBOL(rpc_exit_task);
 
+void rpc_release_calldata(const struct rpc_call_ops *ops, void *calldata)
+{
+        if (ops->rpc_release != NULL) {
+                lock_kernel();
+                ops->rpc_release(calldata);
+                unlock_kernel();
+        }
+}
+
 /*
  * This is the RPC `scheduler' (or rather, the finite state machine).
  */
@@ -615,9 +655,7 @@ static int __rpc_execute(struct rpc_task *task)
                          */
                         save_callback=task->tk_callback;
                         task->tk_callback=NULL;
-                        lock_kernel();
                         save_callback(task);
-                        unlock_kernel();
                 }
 
                 /*
@@ -628,9 +666,7 @@ static int __rpc_execute(struct rpc_task *task)
                 if (!RPC_IS_QUEUED(task)) {
                         if (task->tk_action == NULL)
                                 break;
-                        lock_kernel();
                         task->tk_action(task);
-                        unlock_kernel();
                 }
 
                 /*
@@ -671,8 +707,6 @@ static int __rpc_execute(struct rpc_task *task)
         }
 
         dprintk("RPC: %4d, return %d, status %d\n", task->tk_pid, status, task->tk_status);
-        /* Wake up anyone who is waiting for task completion */
-        rpc_mark_complete_task(task);
         /* Release all resources associated with the task */
         rpc_release_task(task);
         return status;
@@ -786,15 +820,6 @@ void rpc_init_task(struct rpc_task *task, struct rpc_clnt *clnt, int flags, cons
                         task->tk_flags |= RPC_TASK_NOINTR;
         }
 
-#ifdef RPC_DEBUG
-        task->tk_magic = RPC_TASK_MAGIC_ID;
-        task->tk_pid = rpc_task_id++;
-#endif
-        /* Add to global list of all tasks */
-        spin_lock(&rpc_sched_lock);
-        list_add_tail(&task->tk_task, &all_tasks);
-        spin_unlock(&rpc_sched_lock);
-
         BUG_ON(task->tk_ops == NULL);
 
         /* starting timestamp */
@@ -810,8 +835,9 @@ rpc_alloc_task(void)
         return (struct rpc_task *)mempool_alloc(rpc_task_mempool, GFP_NOFS);
 }
 
-static void rpc_free_task(struct rpc_task *task)
+static void rpc_free_task(struct rcu_head *rcu)
 {
+        struct rpc_task *task = container_of(rcu, struct rpc_task, u.tk_rcu);
         dprintk("RPC: %4d freeing task\n", task->tk_pid);
         mempool_free(task, rpc_task_mempool);
 }
@@ -847,16 +873,34 @@ cleanup:
         goto out;
 }
 
-void rpc_release_task(struct rpc_task *task)
+
+void rpc_put_task(struct rpc_task *task)
 {
         const struct rpc_call_ops *tk_ops = task->tk_ops;
         void *calldata = task->tk_calldata;
 
+        if (!atomic_dec_and_test(&task->tk_count))
+                return;
+        /* Release resources */
+        if (task->tk_rqstp)
+                xprt_release(task);
+        if (task->tk_msg.rpc_cred)
+                rpcauth_unbindcred(task);
+        if (task->tk_client) {
+                rpc_release_client(task->tk_client);
+                task->tk_client = NULL;
+        }
+        if (task->tk_flags & RPC_TASK_DYNAMIC)
+                call_rcu_bh(&task->u.tk_rcu, rpc_free_task);
+        rpc_release_calldata(tk_ops, calldata);
+}
+EXPORT_SYMBOL(rpc_put_task);
+
+void rpc_release_task(struct rpc_task *task)
+{
 #ifdef RPC_DEBUG
         BUG_ON(task->tk_magic != RPC_TASK_MAGIC_ID);
 #endif
-        if (!atomic_dec_and_test(&task->tk_count))
-                return;
         dprintk("RPC: %4d release task\n", task->tk_pid);
 
         /* Remove from global task list */
@@ -869,23 +913,13 @@ void rpc_release_task(struct rpc_task *task)
         /* Synchronously delete any running timer */
         rpc_delete_timer(task);
 
-        /* Release resources */
-        if (task->tk_rqstp)
-                xprt_release(task);
-        if (task->tk_msg.rpc_cred)
-                rpcauth_unbindcred(task);
-        if (task->tk_client) {
-                rpc_release_client(task->tk_client);
-                task->tk_client = NULL;
-        }
-
 #ifdef RPC_DEBUG
         task->tk_magic = 0;
 #endif
-        if (task->tk_flags & RPC_TASK_DYNAMIC)
-                rpc_free_task(task);
-        if (tk_ops->rpc_release)
-                tk_ops->rpc_release(calldata);
+        /* Wake up anyone who is waiting for task completion */
+        rpc_mark_complete_task(task);
+
+        rpc_put_task(task);
 }
 
 /**
@@ -902,8 +936,7 @@ struct rpc_task *rpc_run_task(struct rpc_clnt *clnt, int flags,
         struct rpc_task *task;
         task = rpc_new_task(clnt, flags, ops, data);
         if (task == NULL) {
-                if (ops->rpc_release != NULL)
-                        ops->rpc_release(data);
+                rpc_release_calldata(ops, data);
                 return ERR_PTR(-ENOMEM);
         }
         atomic_inc(&task->tk_count);