Revision 10f1d5d111e8aed46a0f1179faf9a3cf422f689e authored by Joe Thornber on 27 June 2014, 19:29:04 UTC, committed by Mike Snitzer on 10 July 2014, 20:44:14 UTC
There's a race condition between the atomic_dec_and_test(&io->count) in dec_count() and the waking of the sync_io() thread. If the thread is spuriously woken immediately after the decrement it may exit, making the on stack io struct invalid, yet the dec_count could still be using it. Fix this race by using a completion in sync_io() and dec_count(). Reported-by: Minfei Huang <huangminfei@ucloud.cn> Signed-off-by: Joe Thornber <thornber@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Acked-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org
1 parent bf14299
File | Mode | Size |
---|---|---|
alchemy | ||
ar7 | ||
ath79 | ||
bcm47xx | ||
bcm63xx | ||
boot | ||
cavium-octeon | ||
cobalt | ||
configs | ||
dec | ||
emma | ||
fw | ||
include | ||
jazz | ||
jz4740 | ||
kernel | ||
kvm | ||
lantiq | ||
lasat | ||
lib | ||
loongson | ||
loongson1 | ||
math-emu | ||
mm | ||
mti-malta | ||
mti-sead3 | ||
net | ||
netlogic | ||
oprofile | ||
paravirt | ||
pci | ||
pmcs-msp71xx | ||
pnx833x | ||
power | ||
ralink | ||
rb532 | ||
sgi-ip22 | ||
sgi-ip27 | ||
sgi-ip32 | ||
sibyte | ||
sni | ||
txx9 | ||
vr41xx | ||
Kbuild | -rw-r--r-- | 542 bytes |
Kbuild.platforms | -rw-r--r-- | 772 bytes |
Kconfig | -rw-r--r-- | 64.6 KB |
Kconfig.debug | -rw-r--r-- | 4.2 KB |
Makefile | -rw-r--r-- | 11.4 KB |
Computing file changes ...