Skip to main content

Browse the archive

Revision 712f3147aee0fbbbbed2da20b21b272c5505125e authored by Linus Torvalds on 13 May 2011, 23:16:41 UTC, committed by Linus Torvalds on 14 May 2011, 17:23:44 UTC 
fbmem: fix remove_conflicting_framebuffers races
 
When a register_framebuffer() call results in us removing old
conflicting framebuffers, the new registration_lock doesn't protect that
situation.  And we can't just add the same locking to the function,
because these functions call each other: register_framebuffer() calls
remove_conflicting_framebuffers, which in turn calls
unregister_framebuffer for any conflicting entry.

In order to fix it, this just creates wrapper functions around all three
functions and makes the versions that actually do the work be called
"do_xxx()", leaving just the wrapper that gets the lock and calls the
worker function.

So the rule becomes simply that "do_xxxx()" has to be called with the
lock held, and now do_register_framebuffer() can just call
do_remove_conflicting_framebuffers(), and that in turn can call
_do_unregister_framebuffer(), and there is no deadlock, and we can hold
the registration lock over the whole sequence, fixing the races.

It also makes error cases simpler, and fixes one situation where we
would return from unregister_framebuffer() without releasing the lock,
pointed out by Bruno Prémont.

Tested-by: Bruno Prémont <bonbons@linux-vserver.org>
Tested-by: Anca Emanuel <anca.emanuel@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent c47747f
Raw File
mpc.h 
#ifndef _MPC_H_
#define _MPC_H_

#include <linux/types.h>
#include <linux/atm.h>
#include <linux/atmmpc.h>
#include <linux/skbuff.h>
#include <linux/spinlock.h>
#include "mpoa_caches.h"

/* kernel -> mpc-daemon */
int msg_to_mpoad(struct k_message *msg, struct mpoa_client *mpc);

struct mpoa_client {
	struct mpoa_client *next;
	struct net_device *dev;      /* lec in question                     */
	int dev_num;                 /* e.g. 2 for lec2                     */

	struct atm_vcc *mpoad_vcc;   /* control channel to mpoad            */
	uint8_t mps_ctrl_addr[ATM_ESA_LEN];  /* MPS control ATM address     */
	uint8_t our_ctrl_addr[ATM_ESA_LEN];  /* MPC's control ATM address   */

	rwlock_t ingress_lock;
	struct in_cache_ops *in_ops; /* ingress cache operations            */
	in_cache_entry *in_cache;    /* the ingress cache of this MPC       */

	rwlock_t egress_lock;
	struct eg_cache_ops *eg_ops; /* egress cache operations             */
	eg_cache_entry *eg_cache;    /* the egress  cache of this MPC       */

	uint8_t *mps_macs;           /* array of MPS MAC addresses, >=1     */
	int number_of_mps_macs;      /* number of the above MAC addresses   */
	struct mpc_parameters parameters;  /* parameters for this client    */

	const struct net_device_ops *old_ops;
	struct net_device_ops new_ops;
};


struct atm_mpoa_qos {
	struct atm_mpoa_qos *next;
	__be32 ipaddr;
	struct atm_qos qos;
};


/* MPOA QoS operations */
struct atm_mpoa_qos *atm_mpoa_add_qos(__be32 dst_ip, struct atm_qos *qos);
struct atm_mpoa_qos *atm_mpoa_search_qos(__be32 dst_ip);
int atm_mpoa_delete_qos(struct atm_mpoa_qos *qos);

/* Display QoS entries. This is for the procfs */
struct seq_file;
void atm_mpoa_disp_qos(struct seq_file *m);

#ifdef CONFIG_PROC_FS
int mpc_proc_init(void);
void mpc_proc_clean(void);
#else
#define mpc_proc_init() (0)
#define mpc_proc_clean() do { } while(0)
#endif

#endif /* _MPC_H_ */
back to top