Commit e6d83d55 authored by Trond Myklebust's avatar Trond Myklebust Committed by Linus Torvalds

[PATCH] SUNRPC: Fix potential deadlock in RPC code

In rpc_wake_up() and rpc_wake_up_status(), it is possible for the call to
__rpc_wake_up_task() to fail if another thread happens to be calling
rpc_wake_up_task() on the same rpc_task.

Problem noticed by Bruno Faccini.
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent c12e87f4
...@@ -515,16 +515,14 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue) ...@@ -515,16 +515,14 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
*/ */
void rpc_wake_up(struct rpc_wait_queue *queue) void rpc_wake_up(struct rpc_wait_queue *queue)
{ {
struct rpc_task *task; struct rpc_task *task, *next;
struct list_head *head; struct list_head *head;
spin_lock_bh(&queue->lock); spin_lock_bh(&queue->lock);
head = &queue->tasks[queue->maxpriority]; head = &queue->tasks[queue->maxpriority];
for (;;) { for (;;) {
while (!list_empty(head)) { list_for_each_entry_safe(task, next, head, u.tk_wait.list)
task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
__rpc_wake_up_task(task); __rpc_wake_up_task(task);
}
if (head == &queue->tasks[0]) if (head == &queue->tasks[0])
break; break;
head--; head--;
...@@ -541,14 +539,13 @@ void rpc_wake_up(struct rpc_wait_queue *queue) ...@@ -541,14 +539,13 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
*/ */
void rpc_wake_up_status(struct rpc_wait_queue *queue, int status) void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
{ {
struct rpc_task *task, *next;
struct list_head *head; struct list_head *head;
struct rpc_task *task;
spin_lock_bh(&queue->lock); spin_lock_bh(&queue->lock);
head = &queue->tasks[queue->maxpriority]; head = &queue->tasks[queue->maxpriority];
for (;;) { for (;;) {
while (!list_empty(head)) { list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
task->tk_status = status; task->tk_status = status;
__rpc_wake_up_task(task); __rpc_wake_up_task(task);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment