diff options
| author | Steffen Klassert <steffen.klassert@secunet.com> | 2012-03-09 07:20:12 +0100 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2012-03-14 17:25:56 +0800 |
| commit | 3047817b894ddae62be07787bc8735a616104398 (patch) | |
| tree | e5eac5f11bb0c34a80224a62892f72a240eb1659 | |
| parent | 0b95ec56ae19f61ca664e83766a2180057f0e351 (diff) | |
| download | linux-3047817b894ddae62be07787bc8735a616104398.tar.bz2 | |
padata: Fix race in the serialization path
When a padata object is queued to the serialization queue, another
cpu might process and free the padata object. So don't dereference
it after queueing to the serialization queue.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | kernel/padata.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/kernel/padata.c b/kernel/padata.c index b45259931512..aa9929545855 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -230,6 +230,7 @@ out: static void padata_reorder(struct parallel_data *pd) { + int cb_cpu; struct padata_priv *padata; struct padata_serial_queue *squeue; struct padata_instance *pinst = pd->pinst; @@ -270,13 +271,14 @@ static void padata_reorder(struct parallel_data *pd) return; } - squeue = per_cpu_ptr(pd->squeue, padata->cb_cpu); + cb_cpu = padata->cb_cpu; + squeue = per_cpu_ptr(pd->squeue, cb_cpu); spin_lock(&squeue->serial.lock); list_add_tail(&padata->list, &squeue->serial.list); spin_unlock(&squeue->serial.lock); - queue_work_on(padata->cb_cpu, pinst->wq, &squeue->work); + queue_work_on(cb_cpu, pinst->wq, &squeue->work); } spin_unlock_bh(&pd->lock); |