mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-09-21 03:43:03 +00:00
dm io: fix a race condition in the wake up code for sync_io
commit 10f1d5d111e8aed46a0f1179faf9a3cf422f689e upstream. There's a race condition between the atomic_dec_and_test(&io->count) in dec_count() and the waking of the sync_io() thread. If the thread is spuriously woken immediately after the decrement it may exit, making the on stack io struct invalid, yet the dec_count could still be using it. Fix this race by using a completion in sync_io() and dec_count(). Reported-by: Minfei Huang <huangminfei@ucloud.cn> Signed-off-by: Joe Thornber <thornber@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Acked-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
17256c6385
commit
09edef606e
|
@ -10,6 +10,7 @@
|
||||||
#include <linux/device-mapper.h>
|
#include <linux/device-mapper.h>
|
||||||
|
|
||||||
#include <linux/bio.h>
|
#include <linux/bio.h>
|
||||||
|
#include <linux/completion.h>
|
||||||
#include <linux/mempool.h>
|
#include <linux/mempool.h>
|
||||||
#include <linux/module.h>
|
#include <linux/module.h>
|
||||||
#include <linux/sched.h>
|
#include <linux/sched.h>
|
||||||
|
@ -34,7 +35,7 @@ struct dm_io_client {
|
||||||
struct io {
|
struct io {
|
||||||
unsigned long error_bits;
|
unsigned long error_bits;
|
||||||
atomic_t count;
|
atomic_t count;
|
||||||
struct task_struct *sleeper;
|
struct completion *wait;
|
||||||
struct dm_io_client *client;
|
struct dm_io_client *client;
|
||||||
io_notify_fn callback;
|
io_notify_fn callback;
|
||||||
void *context;
|
void *context;
|
||||||
|
@ -122,8 +123,8 @@ static void dec_count(struct io *io, unsigned int region, int error)
|
||||||
invalidate_kernel_vmap_range(io->vma_invalidate_address,
|
invalidate_kernel_vmap_range(io->vma_invalidate_address,
|
||||||
io->vma_invalidate_size);
|
io->vma_invalidate_size);
|
||||||
|
|
||||||
if (io->sleeper)
|
if (io->wait)
|
||||||
wake_up_process(io->sleeper);
|
complete(io->wait);
|
||||||
|
|
||||||
else {
|
else {
|
||||||
unsigned long r = io->error_bits;
|
unsigned long r = io->error_bits;
|
||||||
|
@ -386,6 +387,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
|
||||||
*/
|
*/
|
||||||
volatile char io_[sizeof(struct io) + __alignof__(struct io) - 1];
|
volatile char io_[sizeof(struct io) + __alignof__(struct io) - 1];
|
||||||
struct io *io = (struct io *)PTR_ALIGN(&io_, __alignof__(struct io));
|
struct io *io = (struct io *)PTR_ALIGN(&io_, __alignof__(struct io));
|
||||||
|
DECLARE_COMPLETION_ONSTACK(wait);
|
||||||
|
|
||||||
if (num_regions > 1 && (rw & RW_MASK) != WRITE) {
|
if (num_regions > 1 && (rw & RW_MASK) != WRITE) {
|
||||||
WARN_ON(1);
|
WARN_ON(1);
|
||||||
|
@ -394,7 +396,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
|
||||||
|
|
||||||
io->error_bits = 0;
|
io->error_bits = 0;
|
||||||
atomic_set(&io->count, 1); /* see dispatch_io() */
|
atomic_set(&io->count, 1); /* see dispatch_io() */
|
||||||
io->sleeper = current;
|
io->wait = &wait;
|
||||||
io->client = client;
|
io->client = client;
|
||||||
|
|
||||||
io->vma_invalidate_address = dp->vma_invalidate_address;
|
io->vma_invalidate_address = dp->vma_invalidate_address;
|
||||||
|
@ -402,15 +404,7 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
|
||||||
|
|
||||||
dispatch_io(rw, num_regions, where, dp, io, 1);
|
dispatch_io(rw, num_regions, where, dp, io, 1);
|
||||||
|
|
||||||
while (1) {
|
wait_for_completion_io(&wait);
|
||||||
set_current_state(TASK_UNINTERRUPTIBLE);
|
|
||||||
|
|
||||||
if (!atomic_read(&io->count))
|
|
||||||
break;
|
|
||||||
|
|
||||||
io_schedule();
|
|
||||||
}
|
|
||||||
set_current_state(TASK_RUNNING);
|
|
||||||
|
|
||||||
if (error_bits)
|
if (error_bits)
|
||||||
*error_bits = io->error_bits;
|
*error_bits = io->error_bits;
|
||||||
|
@ -433,7 +427,7 @@ static int async_io(struct dm_io_client *client, unsigned int num_regions,
|
||||||
io = mempool_alloc(client->pool, GFP_NOIO);
|
io = mempool_alloc(client->pool, GFP_NOIO);
|
||||||
io->error_bits = 0;
|
io->error_bits = 0;
|
||||||
atomic_set(&io->count, 1); /* see dispatch_io() */
|
atomic_set(&io->count, 1); /* see dispatch_io() */
|
||||||
io->sleeper = NULL;
|
io->wait = NULL;
|
||||||
io->client = client;
|
io->client = client;
|
||||||
io->callback = fn;
|
io->callback = fn;
|
||||||
io->context = context;
|
io->context = context;
|
||||||
|
|
Loading…
Reference in a new issue