Fix some RCU problem pointed out by Paul McKenney of IBM. These are:
The wholesale move of the command receivers list into a new list was
not safe because the list will point to the new tail during a
traversal, so the traversal will never end on a reader if this happens
during a read.
Memory barriers were needed to handle proper ordering of the setting
of the IPMI interface as valid. Readers might not see proper ordering
of data otherwise.
In ipmi_smi_watcher_register(), the use of the _rcu suffix on the list
is unnecessary.
Signed-off-by: Corey Minyard <[EMAIL PROTECTED]>
Cc: Paul E. McKenney <[EMAIL PROTECTED]>
Index: linux-2.6.19/drivers/char/ipmi/ipmi_msghandler.c
===================================================================
--- linux-2.6.19.orig/drivers/char/ipmi/ipmi_msghandler.c
+++ linux-2.6.19/drivers/char/ipmi/ipmi_msghandler.c
@@ -406,13 +406,31 @@ static void clean_up_interface_data(ipmi
free_smi_msg_list(&intf->waiting_msgs);
free_recv_msg_list(&intf->waiting_events);
- /* Wholesale remove all the entries from the list in the
- * interface and wait for RCU to know that none are in use. */
+ /*
+ * Wholesale remove all the entries from the list in the
+ * interface and wait for RCU to know that none are in use.
+ */
mutex_lock(&intf->cmd_rcvrs_mutex);
- list_add_rcu(&list, &intf->cmd_rcvrs);
- list_del_rcu(&intf->cmd_rcvrs);
+ if (list_empty(&intf->cmd_rcvrs))
+ INIT_LIST_HEAD(&list);
+ else {
+ list.next = intf->cmd_rcvrs.next;
+ list.prev = intf->cmd_rcvrs.prev;
+ INIT_LIST_HEAD(&intf->cmd_rcvrs);
+
+ /*
+ * At this point the list body still points to
+ * intf->cmd_rcvrs. Wait for any readers to finish
+ * using the list before we switch the list body over
+ * to the new list.
+ */
+ synchronize_rcu();
+
+ /* Ready the list for use. */
+ list.next->prev = &list;
+ list.prev->next = &list;
+ }
mutex_unlock(&intf->cmd_rcvrs_mutex);
- synchronize_rcu();
list_for_each_entry_safe(rcvr, rcvr2, &list, link)
kfree(rcvr);
@@ -451,7 +469,7 @@ int ipmi_smi_watcher_register(struct ipm
mutex_lock(&ipmi_interfaces_mutex);
/* Build a list of things to deliver. */
- list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
+ list_for_each_entry(intf, &ipmi_interfaces, link) {
if (intf->intf_num == -1)
continue;
e = kmalloc(sizeof(*e), GFP_KERNEL);
@@ -838,6 +856,7 @@ int ipmi_create_user(unsigned int
goto out_kfree;
found:
+ smp_rmb();
/* Note that each existing user holds a refcount to the interface. */
kref_get(&intf->refcount);
@@ -2761,6 +2780,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
kref_put(&intf->refcount, intf_free);
} else {
/* After this point the interface is legal to use. */
+ smp_wmb(); /* Keep memory order straight for RCU readers. */
intf->intf_num = i;
mutex_unlock(&ipmi_interfaces_mutex);
call_smi_watchers(i, intf->si_dev);
@@ -3924,6 +3944,8 @@ static void send_panic_events(char *str)
/* Interface was not ready yet. */
continue;
+ smp_rmb();
+
/* First job here is to figure out where to send the
OEM events. There's no way in IPMI to send OEM
events using an event send command, so we have to
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Openipmi-developer mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openipmi-developer
