Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag '9p-for-7.0-rc1' of https://github.com/martinetd/linux
Pull 9p updates from Dominique Martinet:
- 9p/xen racy double-free fix
- track 9p RPC waiting time as IO
* tag '9p-for-7.0-rc1' of https://github.com/martinetd/linux:
9p/xen: protect xen_9pfs_front_free against concurrent calls
9p: Track 9P RPC waiting time as IO
wait: Introduce io_wait_event_killable()
+67
-49
+15
include/linux/wait.h
+15
include/linux/wait.h
···
937
937
__ret; \
938
938
})
939
939
940
+
#define __io_wait_event_killable(wq, condition) \
941
+
___wait_event(wq, condition, TASK_KILLABLE, 0, 0, io_schedule())
942
+
943
+
/*
944
+
* wait_event_killable() - link wait_event_killable but with io_schedule()
945
+
*/
946
+
#define io_wait_event_killable(wq_head, condition) \
947
+
({ \
948
+
int __ret = 0; \
949
+
might_sleep(); \
950
+
if (!(condition)) \
951
+
__ret = __io_wait_event_killable(wq_head, condition); \
952
+
__ret; \
953
+
})
954
+
940
955
#define __wait_event_state(wq, condition, state) \
941
956
___wait_event(wq, condition, state, 0, 0, schedule())
942
957
+2
-2
net/9p/client.c
+2
-2
net/9p/client.c
···
590
590
}
591
591
again:
592
592
/* Wait for the response */
593
-
err = wait_event_killable(req->wq,
594
-
READ_ONCE(req->status) >= REQ_STATUS_RCVD);
593
+
err = io_wait_event_killable(req->wq,
594
+
READ_ONCE(req->status) >= REQ_STATUS_RCVD);
595
595
596
596
/* Make sure our req is coherent with regard to updates in other
597
597
* threads - echoes to wmb() in the callback
+7
-7
net/9p/trans_virtio.c
+7
-7
net/9p/trans_virtio.c
···
284
284
if (err == -ENOSPC) {
285
285
chan->ring_bufs_avail = 0;
286
286
spin_unlock_irqrestore(&chan->lock, flags);
287
-
err = wait_event_killable(*chan->vc_wq,
288
-
chan->ring_bufs_avail);
287
+
err = io_wait_event_killable(*chan->vc_wq,
288
+
chan->ring_bufs_avail);
289
289
if (err == -ERESTARTSYS)
290
290
return err;
291
291
···
325
325
* Other zc request to finish here
326
326
*/
327
327
if (atomic_read(&vp_pinned) >= chan->p9_max_pages) {
328
-
err = wait_event_killable(vp_wq,
328
+
err = io_wait_event_killable(vp_wq,
329
329
(atomic_read(&vp_pinned) < chan->p9_max_pages));
330
330
if (err == -ERESTARTSYS)
331
331
return err;
···
512
512
if (err == -ENOSPC) {
513
513
chan->ring_bufs_avail = 0;
514
514
spin_unlock_irqrestore(&chan->lock, flags);
515
-
err = wait_event_killable(*chan->vc_wq,
516
-
chan->ring_bufs_avail);
515
+
err = io_wait_event_killable(*chan->vc_wq,
516
+
chan->ring_bufs_avail);
517
517
if (err == -ERESTARTSYS)
518
518
goto err_out;
519
519
···
531
531
spin_unlock_irqrestore(&chan->lock, flags);
532
532
kicked = 1;
533
533
p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
534
-
err = wait_event_killable(req->wq,
535
-
READ_ONCE(req->status) >= REQ_STATUS_RCVD);
534
+
err = io_wait_event_killable(req->wq,
535
+
READ_ONCE(req->status) >= REQ_STATUS_RCVD);
536
536
// RERROR needs reply (== error string) in static data
537
537
if (READ_ONCE(req->status) == REQ_STATUS_RCVD &&
538
538
unlikely(req->rc.sdata[4] == P9_RERROR))
+43
-40
net/9p/trans_xen.c
+43
-40
net/9p/trans_xen.c
···
136
136
ring = &priv->rings[num];
137
137
138
138
again:
139
-
while (wait_event_killable(ring->wq,
140
-
p9_xen_write_todo(ring, size)) != 0)
139
+
while (io_wait_event_killable(ring->wq,
140
+
p9_xen_write_todo(ring, size)) != 0)
141
141
;
142
142
143
143
spin_lock_irqsave(&ring->lock, flags);
···
277
277
{
278
278
int i, j;
279
279
280
-
write_lock(&xen_9pfs_lock);
281
-
list_del(&priv->list);
282
-
write_unlock(&xen_9pfs_lock);
280
+
if (priv->rings) {
281
+
for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
282
+
struct xen_9pfs_dataring *ring = &priv->rings[i];
283
283
284
-
for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
285
-
struct xen_9pfs_dataring *ring = &priv->rings[i];
284
+
cancel_work_sync(&ring->work);
286
285
287
-
cancel_work_sync(&ring->work);
286
+
if (!priv->rings[i].intf)
287
+
break;
288
+
if (priv->rings[i].irq > 0)
289
+
unbind_from_irqhandler(priv->rings[i].irq, ring);
290
+
if (priv->rings[i].data.in) {
291
+
for (j = 0;
292
+
j < (1 << priv->rings[i].intf->ring_order);
293
+
j++) {
294
+
grant_ref_t ref;
288
295
289
-
if (!priv->rings[i].intf)
290
-
break;
291
-
if (priv->rings[i].irq > 0)
292
-
unbind_from_irqhandler(priv->rings[i].irq, ring);
293
-
if (priv->rings[i].data.in) {
294
-
for (j = 0;
295
-
j < (1 << priv->rings[i].intf->ring_order);
296
-
j++) {
297
-
grant_ref_t ref;
298
-
299
-
ref = priv->rings[i].intf->ref[j];
300
-
gnttab_end_foreign_access(ref, NULL);
301
-
}
302
-
free_pages_exact(priv->rings[i].data.in,
296
+
ref = priv->rings[i].intf->ref[j];
297
+
gnttab_end_foreign_access(ref, NULL);
298
+
}
299
+
free_pages_exact(priv->rings[i].data.in,
303
300
1UL << (priv->rings[i].intf->ring_order +
304
301
XEN_PAGE_SHIFT));
302
+
}
303
+
gnttab_end_foreign_access(priv->rings[i].ref, NULL);
304
+
free_page((unsigned long)priv->rings[i].intf);
305
305
}
306
-
gnttab_end_foreign_access(priv->rings[i].ref, NULL);
307
-
free_page((unsigned long)priv->rings[i].intf);
306
+
kfree(priv->rings);
308
307
}
309
-
kfree(priv->rings);
310
308
kfree(priv->tag);
311
309
kfree(priv);
312
310
}
313
311
314
312
static void xen_9pfs_front_remove(struct xenbus_device *dev)
315
313
{
316
-
struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
314
+
struct xen_9pfs_front_priv *priv;
317
315
316
+
write_lock(&xen_9pfs_lock);
317
+
priv = dev_get_drvdata(&dev->dev);
318
+
if (priv == NULL) {
319
+
write_unlock(&xen_9pfs_lock);
320
+
return;
321
+
}
318
322
dev_set_drvdata(&dev->dev, NULL);
323
+
list_del(&priv->list);
324
+
write_unlock(&xen_9pfs_lock);
325
+
319
326
xen_9pfs_front_free(priv);
320
327
}
321
328
···
389
382
{
390
383
int ret, i;
391
384
struct xenbus_transaction xbt;
392
-
struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
385
+
struct xen_9pfs_front_priv *priv;
393
386
char *versions, *v;
394
387
unsigned int max_rings, max_ring_order, len = 0;
395
388
···
417
410
if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order))
418
411
p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2;
419
412
413
+
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
414
+
if (!priv)
415
+
return -ENOMEM;
416
+
priv->dev = dev;
420
417
priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings),
421
418
GFP_KERNEL);
422
419
if (!priv->rings) {
···
479
468
goto error;
480
469
}
481
470
471
+
write_lock(&xen_9pfs_lock);
472
+
dev_set_drvdata(&dev->dev, priv);
473
+
list_add_tail(&priv->list, &xen_9pfs_devs);
474
+
write_unlock(&xen_9pfs_lock);
475
+
482
476
xenbus_switch_state(dev, XenbusStateInitialised);
483
477
return 0;
484
478
···
498
482
static int xen_9pfs_front_probe(struct xenbus_device *dev,
499
483
const struct xenbus_device_id *id)
500
484
{
501
-
struct xen_9pfs_front_priv *priv = NULL;
502
-
503
-
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
504
-
if (!priv)
505
-
return -ENOMEM;
506
-
507
-
priv->dev = dev;
508
-
dev_set_drvdata(&dev->dev, priv);
509
-
510
-
write_lock(&xen_9pfs_lock);
511
-
list_add_tail(&priv->list, &xen_9pfs_devs);
512
-
write_unlock(&xen_9pfs_lock);
513
-
514
485
return 0;
515
486
}
516
487