Commit be3b0753 authored by OGAWA Hirofumi's avatar OGAWA Hirofumi Committed by Jens Axboe

[PATCH] cfq: Further rbtree traversal and cfq_exit_queue() race fix

In current code, we are re-reading cic->key after dead cic->key check.
So, in theory, it may really re-read *after* cfq_exit_queue() seted NULL.

To avoid race, we copy it to stack, then use it. With this change, I
guess gcc will assign cic->key to a register or stack, and it wouldn't
be re-readed.
Signed-off-by: default avatarOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: default avatarJens Axboe <axboe@suse.de>
parent dbecf3ab
...@@ -1487,20 +1487,22 @@ cfq_cic_rb_lookup(struct cfq_data *cfqd, struct io_context *ioc) ...@@ -1487,20 +1487,22 @@ cfq_cic_rb_lookup(struct cfq_data *cfqd, struct io_context *ioc)
{ {
struct rb_node *n; struct rb_node *n;
struct cfq_io_context *cic; struct cfq_io_context *cic;
void *key = cfqd; void *k, *key = cfqd;
restart: restart:
n = ioc->cic_root.rb_node; n = ioc->cic_root.rb_node;
while (n) { while (n) {
cic = rb_entry(n, struct cfq_io_context, rb_node); cic = rb_entry(n, struct cfq_io_context, rb_node);
if (unlikely(!cic->key)) { /* ->key must be copied to avoid race with cfq_exit_queue() */
k = cic->key;
if (unlikely(!k)) {
cfq_drop_dead_cic(ioc, cic); cfq_drop_dead_cic(ioc, cic);
goto restart; goto restart;
} }
if (key < cic->key) if (key < k)
n = n->rb_left; n = n->rb_left;
else if (key > cic->key) else if (key > k)
n = n->rb_right; n = n->rb_right;
else else
return cic; return cic;
...@@ -1516,6 +1518,7 @@ cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc, ...@@ -1516,6 +1518,7 @@ cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc,
struct rb_node **p; struct rb_node **p;
struct rb_node *parent; struct rb_node *parent;
struct cfq_io_context *__cic; struct cfq_io_context *__cic;
void *k;
cic->ioc = ioc; cic->ioc = ioc;
cic->key = cfqd; cic->key = cfqd;
...@@ -1527,14 +1530,16 @@ cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc, ...@@ -1527,14 +1530,16 @@ cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc,
while (*p) { while (*p) {
parent = *p; parent = *p;
__cic = rb_entry(parent, struct cfq_io_context, rb_node); __cic = rb_entry(parent, struct cfq_io_context, rb_node);
if (unlikely(!__cic->key)) { /* ->key must be copied to avoid race with cfq_exit_queue() */
k = __cic->key;
if (unlikely(!k)) {
cfq_drop_dead_cic(ioc, cic); cfq_drop_dead_cic(ioc, cic);
goto restart; goto restart;
} }
if (cic->key < __cic->key) if (cic->key < k)
p = &(*p)->rb_left; p = &(*p)->rb_left;
else if (cic->key > __cic->key) else if (cic->key > k)
p = &(*p)->rb_right; p = &(*p)->rb_right;
else else
BUG(); BUG();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment