summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSteffen Klassert <steffen.klassert@secunet.com>2012-03-09 07:20:12 +0100
committerHerbert Xu <herbert@gondor.apana.org.au>2012-03-14 17:25:56 +0800
commit3047817b894ddae62be07787bc8735a616104398 (patch)
treee5eac5f11bb0c34a80224a62892f72a240eb1659
parent0b95ec56ae19f61ca664e83766a2180057f0e351 (diff)
downloadlinux-3047817b894ddae62be07787bc8735a616104398.tar.gz
linux-3047817b894ddae62be07787bc8735a616104398.tar.bz2
linux-3047817b894ddae62be07787bc8735a616104398.zip
padata: Fix race in the serialization path
When a padata object is queued to the serialization queue, another cpu might process and free the padata object. So don't dereference it after queueing to the serialization queue. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-rw-r--r--kernel/padata.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/kernel/padata.c b/kernel/padata.c
index b45259931512..aa9929545855 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -230,6 +230,7 @@ out:
static void padata_reorder(struct parallel_data *pd)
{
+ int cb_cpu;
struct padata_priv *padata;
struct padata_serial_queue *squeue;
struct padata_instance *pinst = pd->pinst;
@@ -270,13 +271,14 @@ static void padata_reorder(struct parallel_data *pd)
return;
}
- squeue = per_cpu_ptr(pd->squeue, padata->cb_cpu);
+ cb_cpu = padata->cb_cpu;
+ squeue = per_cpu_ptr(pd->squeue, cb_cpu);
spin_lock(&squeue->serial.lock);
list_add_tail(&padata->list, &squeue->serial.list);
spin_unlock(&squeue->serial.lock);
- queue_work_on(padata->cb_cpu, pinst->wq, &squeue->work);
+ queue_work_on(cb_cpu, pinst->wq, &squeue->work);
}
spin_unlock_bh(&pd->lock);