Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 98c1c682 authored by Heiko Carstens's avatar Heiko Carstens Committed by Martin Schwidefsky
Browse files

[S390] cio/crw: add/fix locking 



The crw_unregister_handler uses xchg + synchronize_sched when
unregistering a crw_handler.
This doesn't protect crw_collect_info to potentially jump to NULL since
it has unlocked code like this:

if (crw_handlers[i])
        crw_handlers[i](NULL, NULL, 1);

So add a mutex which protects the crw handler array for changes.

Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent e74fe0ce

drivers/s390/cio/crw.c

+23 −9
Original line number Original line Diff line number Diff line
@@ -9,11 +9,13 @@ 
 */

 */





#include <linux/semaphore.h>

#include <linux/semaphore.h>

#include <linux/mutex.h>

#include <linux/kthread.h>

#include <linux/kthread.h>

#include <linux/init.h>

#include <linux/init.h>

#include <asm/crw.h>

#include <asm/crw.h>





static struct semaphore crw_semaphore;

static struct semaphore crw_semaphore;

static DEFINE_MUTEX(crw_handler_mutex);

static crw_handler_t crw_handlers[NR_RSCS];

static crw_handler_t crw_handlers[NR_RSCS];





/**

/**
@@ -25,11 +27,17 @@ static crw_handler_t crw_handlers[NR_RSCS]; 
 */

 */

int crw_register_handler(int rsc, crw_handler_t handler)

int crw_register_handler(int rsc, crw_handler_t handler)

{

{

	int rc = 0;



	if ((rsc < 0) || (rsc >= NR_RSCS))

	if ((rsc < 0) || (rsc >= NR_RSCS))

		return -EINVAL;

		return -EINVAL;

	if (!cmpxchg(&crw_handlers[rsc], NULL, handler))

	mutex_lock(&crw_handler_mutex);

		return 0;

	if (crw_handlers[rsc])

	return -EBUSY;

		rc = -EBUSY;

	else

		crw_handlers[rsc] = handler;

	mutex_unlock(&crw_handler_mutex);

	return rc;

}

}





/**

/**
@@ -40,8 +48,9 @@ void crw_unregister_handler(int rsc) 
{

{

	if ((rsc < 0) || (rsc >= NR_RSCS))

	if ((rsc < 0) || (rsc >= NR_RSCS))

		return;

		return;

	xchg(&crw_handlers[rsc], NULL);

	mutex_lock(&crw_handler_mutex);

	synchronize_sched();

	crw_handlers[rsc] = NULL;

	mutex_unlock(&crw_handler_mutex);

}

}





/*

/*
@@ -58,6 +67,8 @@ static int crw_collect_info(void *unused) 
	ignore = down_interruptible(&crw_semaphore);

	ignore = down_interruptible(&crw_semaphore);

	chain = 0;

	chain = 0;

	while (1) {

	while (1) {

		crw_handler_t handler;



		if (unlikely(chain > 1)) {

		if (unlikely(chain > 1)) {

			struct crw tmp_crw;

			struct crw tmp_crw;
@@ -90,10 +101,12 @@ static int crw_collect_info(void *unused) 
			int i;

			int i;





			pr_debug("%s: crw overflow detected!\n", __func__);

			pr_debug("%s: crw overflow detected!\n", __func__);

			mutex_lock(&crw_handler_mutex);

			for (i = 0; i < NR_RSCS; i++) {

			for (i = 0; i < NR_RSCS; i++) {

				if (crw_handlers[i])

				if (crw_handlers[i])

					crw_handlers[i](NULL, NULL, 1);

					crw_handlers[i](NULL, NULL, 1);

			}

			}

			mutex_unlock(&crw_handler_mutex);

			chain = 0;

			chain = 0;

			continue;

			continue;

		}

		}
@@ -101,10 +114,11 @@ static int crw_collect_info(void *unused) 
			chain++;

			chain++;

			continue;

			continue;

		}

		}

		if (crw_handlers[crw[chain].rsc])

		mutex_lock(&crw_handler_mutex);

			crw_handlers[crw[chain].rsc](&crw[0],

		handler = crw_handlers[crw[chain].rsc];

						     chain ? &crw[1] : NULL,

		if (handler)

						     0);

			handler(&crw[0], chain ? &crw[1] : NULL, 0);

		mutex_unlock(&crw_handler_mutex);

		/* chain is always 0 or 1 here. */

		/* chain is always 0 or 1 here. */

		chain = crw[chain].chn ? chain + 1 : 0;

		chain = crw[chain].chn ? chain + 1 : 0;

	}

	}