Revision 10f1d5d111e8aed46a0f1179faf9a3cf422f689e authored by Joe Thornber on 27 June 2014, 19:29:04 UTC, committed by Mike Snitzer on 10 July 2014, 20:44:14 UTC
There's a race condition between the atomic_dec_and_test(&io->count) in dec_count() and the waking of the sync_io() thread. If the thread is spuriously woken immediately after the decrement it may exit, making the on stack io struct invalid, yet the dec_count could still be using it. Fix this race by using a completion in sync_io() and dec_count(). Reported-by: Minfei Huang <huangminfei@ucloud.cn> Signed-off-by: Joe Thornber <thornber@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Acked-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org
1 parent bf14299
| File | Mode | Size |
|---|---|---|
| check-all.sh | -rw-r--r-- | 433 bytes |
| rt-tester.py | -rw-r--r-- | 5.2 KB |
| t2-l1-2rt-sameprio.tst | -rw-r--r-- | 1.5 KB |
| t2-l1-pi.tst | -rw-r--r-- | 1.2 KB |
| t2-l1-signal.tst | -rw-r--r-- | 1.2 KB |
| t2-l2-2rt-deadlock.tst | -rw-r--r-- | 1.3 KB |
| t3-l1-pi-1rt.tst | -rw-r--r-- | 1.4 KB |
| t3-l1-pi-2rt.tst | -rw-r--r-- | 1.4 KB |
| t3-l1-pi-3rt.tst | -rw-r--r-- | 1.4 KB |
| t3-l1-pi-signal.tst | -rw-r--r-- | 1.5 KB |
| t3-l1-pi-steal.tst | -rw-r--r-- | 1.6 KB |
| t3-l2-pi.tst | -rw-r--r-- | 1.4 KB |
| t4-l2-pi-deboost.tst | -rw-r--r-- | 2.0 KB |
| t5-l4-pi-boost-deboost-setsched.tst | -rw-r--r-- | 2.9 KB |
| t5-l4-pi-boost-deboost.tst | -rw-r--r-- | 2.2 KB |
Computing file changes ...
