Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be3b0753 authored by OGAWA Hirofumi's avatar OGAWA Hirofumi Committed by Jens Axboe
Browse files

[PATCH] cfq: Further rbtree traversal and cfq_exit_queue() race fix 



In current code, we are re-reading cic->key after dead cic->key check.
So, in theory, it may really re-read *after* cfq_exit_queue() seted NULL.

To avoid race, we copy it to stack, then use it. With this change, I
guess gcc will assign cic->key to a register or stack, and it wouldn't
be re-readed.

Signed-off-by: default avatarOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: default avatarJens Axboe <axboe@suse.de>
parent dbecf3ab

block/cfq-iosched.c

+12 −7
Original line number Diff line number Diff line
@@ -1487,20 +1487,22 @@ cfq_cic_rb_lookup(struct cfq_data *cfqd, struct io_context *ioc) 
{

	struct rb_node *n;

	struct cfq_io_context *cic;

	void *key = cfqd;

	void *k, *key = cfqd;



restart:

	n = ioc->cic_root.rb_node;

	while (n) {

		cic = rb_entry(n, struct cfq_io_context, rb_node);

		if (unlikely(!cic->key)) {

		/* ->key must be copied to avoid race with cfq_exit_queue() */

		k = cic->key;

		if (unlikely(!k)) {

			cfq_drop_dead_cic(ioc, cic);

			goto restart;

		}



		if (key < cic->key)

		if (key < k)

			n = n->rb_left;

		else if (key > cic->key)

		else if (key > k)

			n = n->rb_right;

		else

			return cic;
@@ -1516,6 +1518,7 @@ cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc, 
	struct rb_node **p;

	struct rb_node *parent;

	struct cfq_io_context *__cic;

	void *k;



	cic->ioc = ioc;

	cic->key = cfqd;
@@ -1527,14 +1530,16 @@ cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc, 
	while (*p) {

		parent = *p;

		__cic = rb_entry(parent, struct cfq_io_context, rb_node);

		if (unlikely(!__cic->key)) {

		/* ->key must be copied to avoid race with cfq_exit_queue() */

		k = __cic->key;

		if (unlikely(!k)) {

			cfq_drop_dead_cic(ioc, cic);

			goto restart;

		}



		if (cic->key < __cic->key)

		if (cic->key < k)

			p = &(*p)->rb_left;

		else if (cic->key > __cic->key)

		else if (cic->key > k)

			p = &(*p)->rb_right;

		else

			BUG();