• Stefan Richter's avatar
    firewire: core: fix race at address_handler unregistration · 90963f1c
    Stefan Richter authored
    Fix the following unlikely but possible race:
    
    CPU 1                             CPU 2
    ------------------------------------------------------------------------
    AR-request tasklet
        lookup handler
                                      unregister handler
    				  free handler->callback_data or handler
        call handler->callback
    
    The application which registered the handler has no way to stop nodes
    sending new requests to their address range, hence cannot prevent this
    race.
    
    Fix it simply by extending the address_handler_lock-protected region
    from only around the lookup to around both lookup and call.  We only
    need to do so in the exclusive region handler; the FCP region handler
    already holds the lock around the handler->callback call.
    
    Alas this removes the current ability to execute the callback in
    parallel on different CPUs if it was called for different FireWire cards
    at the same time.  (For a single card, the handler is already
    serialized.)  If this loss of a rather obscure feature is not tolerable,
    a more complex fix would be required:  Add a handler reference counter;
    wait in fw_core_remove_address_handler() for this conter to become zero.
    Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
    90963f1c
core-transaction.c 34 KB