Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://brick.kernel.dk/data/git/linux-2.6-block
* 'for-linus' of git://brick.kernel.dk/data/git/linux-2.6-block:
[PATCH] cfq: Further rbtree traversal and cfq_exit_queue() race fix
[PATCH 2/2] cfq: fix cic's rbtree traversal
[PATCH 1/2] iosched: fix typo and barrier()
+43
-15
+3
-2
block/as-iosched.c
+3
-2
block/as-iosched.c
···
1844
1844
DECLARE_COMPLETION(all_gone);
1845
1845
elv_unregister(&iosched_as);
1846
1846
ioc_gone = &all_gone;
1847
-
barrier();
1847
+
/* ioc_gone's update must be visible before reading ioc_count */
1848
+
smp_wmb();
1848
1849
if (atomic_read(&ioc_count))
1849
-
complete(ioc_gone);
1850
+
wait_for_completion(ioc_gone);
1850
1851
synchronize_rcu();
1851
1852
kmem_cache_destroy(arq_pool);
1852
1853
}
+40
-13
block/cfq-iosched.c
+40
-13
block/cfq-iosched.c
···
1472
1472
return cfqq;
1473
1473
}
1474
1474
1475
+
static void
1476
+
cfq_drop_dead_cic(struct io_context *ioc, struct cfq_io_context *cic)
1477
+
{
1478
+
read_lock(&cfq_exit_lock);
1479
+
rb_erase(&cic->rb_node, &ioc->cic_root);
1480
+
read_unlock(&cfq_exit_lock);
1481
+
kmem_cache_free(cfq_ioc_pool, cic);
1482
+
atomic_dec(&ioc_count);
1483
+
}
1484
+
1475
1485
static struct cfq_io_context *
1476
1486
cfq_cic_rb_lookup(struct cfq_data *cfqd, struct io_context *ioc)
1477
1487
{
1478
-
struct rb_node *n = ioc->cic_root.rb_node;
1488
+
struct rb_node *n;
1479
1489
struct cfq_io_context *cic;
1480
-
void *key = cfqd;
1490
+
void *k, *key = cfqd;
1481
1491
1492
+
restart:
1493
+
n = ioc->cic_root.rb_node;
1482
1494
while (n) {
1483
1495
cic = rb_entry(n, struct cfq_io_context, rb_node);
1496
+
/* ->key must be copied to avoid race with cfq_exit_queue() */
1497
+
k = cic->key;
1498
+
if (unlikely(!k)) {
1499
+
cfq_drop_dead_cic(ioc, cic);
1500
+
goto restart;
1501
+
}
1484
1502
1485
-
if (key < cic->key)
1503
+
if (key < k)
1486
1504
n = n->rb_left;
1487
-
else if (key > cic->key)
1505
+
else if (key > k)
1488
1506
n = n->rb_right;
1489
1507
else
1490
1508
return cic;
···
1515
1497
cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc,
1516
1498
struct cfq_io_context *cic)
1517
1499
{
1518
-
struct rb_node **p = &ioc->cic_root.rb_node;
1519
-
struct rb_node *parent = NULL;
1500
+
struct rb_node **p;
1501
+
struct rb_node *parent;
1520
1502
struct cfq_io_context *__cic;
1521
-
1522
-
read_lock(&cfq_exit_lock);
1503
+
void *k;
1523
1504
1524
1505
cic->ioc = ioc;
1525
1506
cic->key = cfqd;
1526
1507
1527
1508
ioc->set_ioprio = cfq_ioc_set_ioprio;
1528
-
1509
+
restart:
1510
+
parent = NULL;
1511
+
p = &ioc->cic_root.rb_node;
1529
1512
while (*p) {
1530
1513
parent = *p;
1531
1514
__cic = rb_entry(parent, struct cfq_io_context, rb_node);
1515
+
/* ->key must be copied to avoid race with cfq_exit_queue() */
1516
+
k = __cic->key;
1517
+
if (unlikely(!k)) {
1518
+
cfq_drop_dead_cic(ioc, cic);
1519
+
goto restart;
1520
+
}
1532
1521
1533
-
if (cic->key < __cic->key)
1522
+
if (cic->key < k)
1534
1523
p = &(*p)->rb_left;
1535
-
else if (cic->key > __cic->key)
1524
+
else if (cic->key > k)
1536
1525
p = &(*p)->rb_right;
1537
1526
else
1538
1527
BUG();
1539
1528
}
1540
1529
1530
+
read_lock(&cfq_exit_lock);
1541
1531
rb_link_node(&cic->rb_node, parent, p);
1542
1532
rb_insert_color(&cic->rb_node, &ioc->cic_root);
1543
1533
list_add(&cic->queue_list, &cfqd->cic_list);
···
2465
2439
DECLARE_COMPLETION(all_gone);
2466
2440
elv_unregister(&iosched_cfq);
2467
2441
ioc_gone = &all_gone;
2468
-
barrier();
2442
+
/* ioc_gone's update must be visible before reading ioc_count */
2443
+
smp_wmb();
2469
2444
if (atomic_read(&ioc_count))
2470
-
complete(ioc_gone);
2445
+
wait_for_completion(ioc_gone);
2471
2446
synchronize_rcu();
2472
2447
cfq_slab_kill();
2473
2448
}