hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux-sg2042/block
History
Alexander Gordeev 2971c35f35 blk-mq: bitmap tag: fix race on blk_mq_bitmap_tags::wake_cnt 
This piece of code in bt_clear_tag() function is racy:

	bs = bt_wake_ptr(bt);
	if (bs && atomic_dec_and_test(&bs->wait_cnt)) {
		atomic_set(&bs->wait_cnt, bt->wake_cnt);
 		wake_up(&bs->wait);
	}

Since nothing prevents bt_wake_ptr() from returning the very
same 'bs' address on multiple CPUs, the following scenario is
possible:

    CPU1                                CPU2
    ----                                ----

0.  bs = bt_wake_ptr(bt);               bs = bt_wake_ptr(bt);
1.  atomic_dec_and_test(&bs->wait_cnt)
2.                                      atomic_dec_and_test(&bs->wait_cnt)
3.  atomic_set(&bs->wait_cnt, bt->wake_cnt);

If the decrement in [1] yields zero then for some amount of time
the decrement in [2] results in a negative/overflow value, which
is not expected. The follow-up assignment in [3] overwrites the
invalid value with the batch value (and likely prevents the issue
from being severe) which is still incorrect and should be a lesser.

Cc: Ming Lei <tom.leiming@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
 		2014-06-17 22:13:05 -07:00
..
partitions block: Use macros from compiler.h instead of __attribute__((...)) 2014-02-18 12:20:01 -08:00
Kconfig block: change config option name for cmdline partition parsing 2013-09-30 14:31:02 -07:00
Kconfig.iosched blkcg: make CONFIG_BLK_CGROUP bool 2012-03-06 21:27:21 +01:00
Makefile block: move mm/bounce.c to block/ 2014-05-19 20:01:52 -06:00
bio-integrity.c block: move bio.c and bio-integrity.c from fs/ to block/ 2014-05-19 08:34:46 -06:00
bio.c Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2014-06-11 08:41:17 -07:00
blk-cgroup.c Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2014-06-11 08:41:17 -07:00
blk-cgroup.h Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2014-06-11 08:41:17 -07:00
blk-core.c block: remove WQ_POWER_EFFICIENT from kblockd 2014-06-11 15:53:39 -06:00
blk-exec.c block: blk-exec.c: Cleaning up local variable address returnd 2014-06-08 19:51:31 -06:00
blk-flush.c block: remove elv_abort_queue and blk_abort_flushes 2014-06-11 15:31:21 -06:00
blk-integrity.c bio-integrity: Convert to bvec_iter 2013-11-23 22:33:50 -08:00
blk-ioc.c block: Substitute rcu_access_pointer() for rcu_dereference_raw() 2014-02-18 12:21:26 -08:00
blk-iopoll.c Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next 2014-06-03 12:57:53 -07:00
blk-lib.c block/blk-lib.c: make __blkdev_issue_zeroout static 2014-05-26 17:39:09 -06:00
blk-map.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00
blk-merge.c block: add queue flag for disabling SG merging 2014-05-29 09:53:32 -06:00
blk-mq-cpu.c blk-mq: add file comments and update copyright notices 2014-05-28 10:15:41 -06:00
blk-mq-cpumap.c blk-mq: add file comments and update copyright notices 2014-05-28 10:15:41 -06:00
blk-mq-sysfs.c blk-mq: blk_mq_unregister_hctx() can be static 2014-05-30 10:31:13 -06:00
blk-mq-tag.c blk-mq: bitmap tag: fix race on blk_mq_bitmap_tags::wake_cnt 2014-06-17 22:13:05 -07:00
blk-mq-tag.h blk-mq: bitmap tag: fix races on shared ::wake_index fields 2014-06-17 22:12:35 -07:00
blk-mq.c blk-mq: merge blk_mq_drain_queue and __blk_mq_drain_queue 2014-06-13 12:17:40 -06:00
blk-mq.h blk-mq: fix schedule from atomic context 2014-06-03 21:04:39 -06:00
blk-settings.c block: ensure that bio_add_page() always accepts a page for an empty bio 2014-06-10 12:53:56 -06:00
blk-softirq.c block: fix regression with block enabled tagging 2014-04-09 21:54:06 -06:00
blk-sysfs.c block: only allocate/free mq_usage_counter in blk-mq 2014-05-27 09:37:08 -06:00
blk-tag.c block: Reserve only one queue tag for sync IO if only 3 tags are available 2013-06-28 21:32:27 +02:00
blk-throttle.c Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 2014-06-09 15:03:33 -07:00
blk-timeout.c block: ensure that the timer is always added 2014-05-30 15:41:39 -06:00
blk.h block: remove elv_abort_queue and blk_abort_flushes 2014-06-11 15:31:21 -06:00
bounce.c mm: convert some level-less printks to pr_* 2014-06-06 16:08:18 -07:00
bsg-lib.c bsg: Remove unused function bsg_goose_queue() 2012-12-06 14:33:02 +01:00
bsg.c block: add blk_rq_set_block_pc() 2014-06-06 07:57:37 -06:00
cfq-iosched.c Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 2014-06-09 15:03:33 -07:00
cmdline-parser.c block: remove unrelated header files and export symbol 2014-01-21 20:18:26 -08:00
compat_ioctl.c kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() 2013-09-11 15:58:18 -07:00
deadline-iosched.c block: Stop abusing csd.list for fifo_time 2014-02-24 14:46:32 -08:00
elevator.c block: remove elv_abort_queue and blk_abort_flushes 2014-06-11 15:31:21 -06:00
genhd.c block: Convert kmalloc_node(...GFP_ZERO...) to kzalloc_node(...) 2013-09-11 13:22:03 -06:00
ioctl.c block: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO 2013-11-08 09:05:31 -07:00
ioprio.c block: move ioprio.c from fs/ to block/ 2014-05-19 11:02:18 -06:00
noop-iosched.c elevator: Fix a race in elevator switching 2013-07-03 13:25:24 +02:00
partition-generic.c Revert "loop: cleanup partitions when detaching loop device" 2013-04-08 10:12:11 +02:00
scsi_ioctl.c block: add blk_rq_set_block_pc() 2014-06-06 07:57:37 -06:00