Commit 0462194d authored by Simon Derr's avatar Simon Derr Committed by Eric Van Hensbergen

9P: Fix race in p9_read_work()

Race scenario between p9_read_work() and p9_poll_mux()

Data arrive, Rworksched is set, p9_read_work() is called.

thread A                                thread B

                                        p9_read_work()
                                                .
                                        reads data
                                                .
                                        checks if new data ready. No.
                                                .
                                        gets preempted
                                                .
More data arrive, p9_poll_mux() is called.      .
                                                .
                                                .
p9_poll_mux()                                   .
                                                .
if (!test_and_set_bit(Rworksched,               .
                      &m->wsched)) {            .
  schedule_work(&m->rq);                        .
}                                               .
                                                .
-> does not schedule work because               .
   Rworksched is set                            .
                                                .
                                        clear_bit(Rworksched, &m->wsched);
                                        return;

No work has been scheduled, and yet data are waiting.

Currently p9_read_work() checks if there is data to read,
and if not, it clears Rworksched.

I think it should clear Rworksched first, and then check if there is data to read.
Signed-off-by: default avatarSimon Derr <simon.derr@bull.net>
Signed-off-by: default avatarEric Van Hensbergen <ericvh@gmail.com>
parent e549c133
...@@ -316,8 +316,7 @@ static void p9_read_work(struct work_struct *work) ...@@ -316,8 +316,7 @@ static void p9_read_work(struct work_struct *work)
m->rsize - m->rpos); m->rsize - m->rpos);
p9_debug(P9_DEBUG_TRANS, "mux %p got %d bytes\n", m, err); p9_debug(P9_DEBUG_TRANS, "mux %p got %d bytes\n", m, err);
if (err == -EAGAIN) { if (err == -EAGAIN) {
clear_bit(Rworksched, &m->wsched); goto end_clear;
return;
} }
if (err <= 0) if (err <= 0)
...@@ -379,19 +378,20 @@ static void p9_read_work(struct work_struct *work) ...@@ -379,19 +378,20 @@ static void p9_read_work(struct work_struct *work)
m->req = NULL; m->req = NULL;
} }
end_clear:
clear_bit(Rworksched, &m->wsched);
if (!list_empty(&m->req_list)) { if (!list_empty(&m->req_list)) {
if (test_and_clear_bit(Rpending, &m->wsched)) if (test_and_clear_bit(Rpending, &m->wsched))
n = POLLIN; n = POLLIN;
else else
n = p9_fd_poll(m->client, NULL); n = p9_fd_poll(m->client, NULL);
if (n & POLLIN) { if ((n & POLLIN) && !test_and_set_bit(Rworksched, &m->wsched)) {
p9_debug(P9_DEBUG_TRANS, "sched read work %p\n", m); p9_debug(P9_DEBUG_TRANS, "sched read work %p\n", m);
schedule_work(&m->rq); schedule_work(&m->rq);
} else }
clear_bit(Rworksched, &m->wsched); }
} else
clear_bit(Rworksched, &m->wsched);
return; return;
error: error:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment