Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f1cffcbf authored by Andy Grover's avatar Andy Grover Committed by David S. Miller
Browse files

RDS: Fix m_rs_lock deadlock 



rs_send_drop_to() is called during socket close. If it takes
m_rs_lock without disabling interrupts, then
rds_send_remove_from_sock() can run from the rx completion
handler and thus deadlock.

Signed-off-by: default avatarAndy Grover <andy.grover@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f1782852

net/rds/send.c

+3 −3
Original line number Diff line number Diff line
@@ -615,7 +615,7 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest) 
{

	struct rds_message *rm, *tmp;

	struct rds_connection *conn;

	unsigned long flags;

	unsigned long flags, flags2;

	LIST_HEAD(list);

	int wake = 0;
@@ -651,9 +651,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest) 
	list_for_each_entry(rm, &list, m_sock_item) {

		/* We do this here rather than in the loop above, so that

		 * we don't have to nest m_rs_lock under rs->rs_lock */

		spin_lock(&rm->m_rs_lock);

		spin_lock_irqsave(&rm->m_rs_lock, flags2);

		rm->m_rs = NULL;

		spin_unlock(&rm->m_rs_lock);

		spin_unlock_irqrestore(&rm->m_rs_lock, flags2);



		/*

		 * If we see this flag cleared then we're *sure* that someone