diff options
| author | wuchi <wuchi.zero@gmail.com> | 2022-06-05 22:58:35 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-06-25 10:58:55 -0600 |
| commit | fbb564a557809466c171b95f8d593a0972450ff2 (patch) | |
| tree | 9d4db32a35428644a80a8b96c48b898063f7a98e /lib/sbitmap.c | |
| parent | e531485a0a0e0a06644de1b639502471415d5e12 (diff) | |
| download | linux-stable-fbb564a557809466c171b95f8d593a0972450ff2.tar.gz linux-stable-fbb564a557809466c171b95f8d593a0972450ff2.tar.bz2 linux-stable-fbb564a557809466c171b95f8d593a0972450ff2.zip | |
lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()
1. Getting next index before continue branch.
2. Checking free bits when setting the target bits. Otherwise,
it may reuse the busying bits.
Signed-off-by: wuchi <wuchi.zero@gmail.com>
Reviewed-by: Martin Wilck <mwilck@suse.com>
Link: https://lore.kernel.org/r/20220605145835.26916-1-wuchi.zero@gmail.com
Fixes: 9672b0d43782 ("sbitmap: add __sbitmap_queue_get_batch()")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'lib/sbitmap.c')
| -rw-r--r-- | lib/sbitmap.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lib/sbitmap.c b/lib/sbitmap.c index ae4fd4de9ebe..29eb0484215a 100644 --- a/lib/sbitmap.c +++ b/lib/sbitmap.c @@ -528,7 +528,7 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags, sbitmap_deferred_clear(map); if (map->word == (1UL << (map_depth - 1)) - 1) - continue; + goto next; nr = find_first_zero_bit(&map->word, map_depth); if (nr + nr_tags <= map_depth) { @@ -539,6 +539,8 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags, get_mask = ((1UL << map_tags) - 1) << nr; do { val = READ_ONCE(map->word); + if ((val & ~get_mask) != val) + goto next; ret = atomic_long_cmpxchg(ptr, val, get_mask | val); } while (ret != val); get_mask = (get_mask & ~ret) >> nr; @@ -549,6 +551,7 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags, return get_mask; } } +next: /* Jump to next index. */ if (++index >= sb->map_nr) index = 0; |