summaryrefslogtreecommitdiff
path: root/net/sunrpc
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.de>2010-09-22 06:55:06 +0400
committerJ. Bruce Fields <bfields@redhat.com>2010-10-02 02:09:54 +0400
commit277f68dbba397997c7f3dc843d14afa1654bb80e (patch)
tree7c9856840c40a3f08bef3a965a9f3c39937c9e99 /net/sunrpc
parent14ec63c3336af7ea5445e0d8f4d26ba3041e40b3 (diff)
downloadlinux-277f68dbba397997c7f3dc843d14afa1654bb80e.tar.xz
sunrpc: fix race in new cache_wait code.
If we set up to wait for a cache item to be filled in, and then find that it is no longer pending, it could be that some other thread is in 'cache_revisit_request' and has moved our request to its 'pending' list. So when our setup_deferral calls cache_revisit_request it will find nothing to put on the pending list, and do nothing. We then return from cache_wait_req, thus leaving the 'sleeper' on-stack structure open to being corrupted by subsequent stack usage. However that 'sleeper' could still be on the 'pending' list that the other thread is looking at and so any corruption could cause it to behave badly. To avoid this race we simply take the same path as if the 'wait_for_completion_interruptible_timeout' was interrupted and if the sleeper is no longer on the list (which it won't be) we wait on the completion - which will ensure that any other cache_revisit_request will have let go of the sleeper. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Diffstat (limited to 'net/sunrpc')
-rw-r--r--net/sunrpc/cache.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index e20968aac68a..1e72cc955931 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -578,10 +578,9 @@ static int cache_wait_req(struct cache_req *req, struct cache_head *item)
dreq->revisit = cache_restart_thread;
ret = setup_deferral(dreq, item);
- if (ret)
- return ret;
- if (wait_for_completion_interruptible_timeout(
+ if (ret ||
+ wait_for_completion_interruptible_timeout(
&sleeper.completion, req->thread_wait) <= 0) {
/* The completion wasn't completed, so we need
* to clean up