evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[S390] cio/crw: add/fix locking

Browse source 
The crw_unregister_handler uses xchg + synchronize_sched when
unregistering a crw_handler.
This doesn't protect crw_collect_info to potentially jump to NULL since
it has unlocked code like this:

if (crw_handlers[i])
        crw_handlers[i](NULL, NULL, 1);

So add a mutex which protects the crw handler array for changes.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Heiko Carstens 2009-03-26 15:24:09 +01:00 • committed by Martin Schwidefsky
parent e74fe0cec9
commit 98c1c68252
1 changed files with 23 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
drivers/s390/cio/crw.c
View file

@ -9,11 +9,13 @@
*/ */
#include <linux/semaphore.h> #include <linux/semaphore.h>
#include <linux/mutex.h>
#include <linux/kthread.h> #include <linux/kthread.h>
#include <linux/init.h> #include <linux/init.h>
#include <asm/crw.h> #include <asm/crw.h>
static struct semaphore crw_semaphore; static struct semaphore crw_semaphore;
static DEFINE_MUTEX(crw_handler_mutex);
static crw_handler_t crw_handlers[NR_RSCS]; static crw_handler_t crw_handlers[NR_RSCS];
/** /**
@ -25,11 +27,17 @@ static crw_handler_t crw_handlers[NR_RSCS];
*/ */
int crw_register_handler(int rsc, crw_handler_t handler) int crw_register_handler(int rsc, crw_handler_t handler)
{ {
int rc = 0;
if ((rsc < 0) || (rsc >= NR_RSCS)) if ((rsc < 0) || (rsc >= NR_RSCS))
return -EINVAL; return -EINVAL;
if (!cmpxchg(&crw_handlers[rsc], NULL, handler)) mutex_lock(&crw_handler_mutex);
return 0; if (crw_handlers[rsc])
return -EBUSY; rc = -EBUSY;
else
crw_handlers[rsc] = handler;
mutex_unlock(&crw_handler_mutex);
return rc;
} }
/** /**
@ -40,8 +48,9 @@ void crw_unregister_handler(int rsc)
{ {
if ((rsc < 0) || (rsc >= NR_RSCS)) if ((rsc < 0) || (rsc >= NR_RSCS))
return; return;
xchg(&crw_handlers[rsc], NULL); mutex_lock(&crw_handler_mutex);
synchronize_sched(); crw_handlers[rsc] = NULL;
mutex_unlock(&crw_handler_mutex);
} }
/* /*
@ -58,6 +67,8 @@ repeat:
ignore = down_interruptible(&crw_semaphore); ignore = down_interruptible(&crw_semaphore);
chain = 0; chain = 0;
while (1) { while (1) {
crw_handler_t handler;
if (unlikely(chain > 1)) { if (unlikely(chain > 1)) {
struct crw tmp_crw; struct crw tmp_crw;
@ -90,10 +101,12 @@ repeat:
int i; int i;
pr_debug("%s: crw overflow detected!\n", __func__); pr_debug("%s: crw overflow detected!\n", __func__);
mutex_lock(&crw_handler_mutex);
for (i = 0; i < NR_RSCS; i++) { for (i = 0; i < NR_RSCS; i++) {
if (crw_handlers[i]) if (crw_handlers[i])
crw_handlers[i](NULL, NULL, 1); crw_handlers[i](NULL, NULL, 1);
} }
mutex_unlock(&crw_handler_mutex);
chain = 0; chain = 0;
continue; continue;
} }
@ -101,10 +114,11 @@ repeat:
chain++; chain++;
continue; continue;
} }
if (crw_handlers[crw[chain].rsc]) mutex_lock(&crw_handler_mutex);
crw_handlers[crw[chain].rsc](&crw[0], handler = crw_handlers[crw[chain].rsc];
chain ? &crw[1] : NULL, if (handler)
0); handler(&crw[0], chain ? &crw[1] : NULL, 0);
mutex_unlock(&crw_handler_mutex);
/* chain is always 0 or 1 here. */ /* chain is always 0 or 1 here. */
chain = crw[chain].chn ? chain + 1 : 0; chain = crw[chain].chn ? chain + 1 : 0;
} }