SUNRPC: Fix a potential race in rpc_wake_up_task()
Use RCU to ensure that we can safely call rpc_finish_wakeup after we've called __rpc_do_wake_up_task. If not, there is a theoretical race, in which the rpc_task finishes executing, and gets freed first. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
This commit is contained in:
@@ -65,13 +65,19 @@ struct nfs_read_data *nfs_readdata_alloc(size_t len)
|
||||
return p;
|
||||
}
|
||||
|
||||
static void nfs_readdata_free(struct nfs_read_data *p)
|
||||
static void nfs_readdata_rcu_free(struct rcu_head *head)
|
||||
{
|
||||
struct nfs_read_data *p = container_of(head, struct nfs_read_data, task.u.tk_rcu);
|
||||
if (p && (p->pagevec != &p->page_array[0]))
|
||||
kfree(p->pagevec);
|
||||
mempool_free(p, nfs_rdata_mempool);
|
||||
}
|
||||
|
||||
static void nfs_readdata_free(struct nfs_read_data *rdata)
|
||||
{
|
||||
call_rcu_bh(&rdata->task.u.tk_rcu, nfs_readdata_rcu_free);
|
||||
}
|
||||
|
||||
void nfs_readdata_release(void *data)
|
||||
{
|
||||
nfs_readdata_free(data);
|
||||
|
Reference in New Issue
Block a user