diff options
author | Sonny Rao <sonny@burdell.org> | 2006-06-25 05:49:34 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-06-25 10:01:26 -0700 |
commit | 1eec00565d849ceda67f425e089c3233e3ef2ca2 (patch) | |
tree | 83f5bb133755ddde28772e64b99ff0cfd701f0d7 /lib | |
parent | a45219483e2894af3c07f959cbd4edb4575b4f8c (diff) | |
download | kernel-common-1eec00565d849ceda67f425e089c3233e3ef2ca2.tar.gz kernel-common-1eec00565d849ceda67f425e089c3233e3ef2ca2.tar.bz2 kernel-common-1eec00565d849ceda67f425e089c3233e3ef2ca2.zip |
[PATCH] fix race in idr code
I ran into a bug where the kernel died in the idr code:
cpu 0x1d: Vector: 300 (Data Access) at [c000000b7096f710]
pc: c0000000001f8984: .idr_get_new_above_int+0x140/0x330
lr: c0000000001f89b4: .idr_get_new_above_int+0x170/0x330
sp: c000000b7096f990
msr: 800000000000b032
dar: 0
dsisr: 40010000
current = 0xc000000b70d43830
paca = 0xc000000000556900
pid = 2022, comm = hwup
1d:mon> t
[c000000b7096f990] c0000000000d2ad8 .expand_files+0x2e8/0x364 (unreliable)
[c000000b7096faa0] c0000000001f8bf8 .idr_get_new_above+0x18/0x68
[c000000b7096fb20] c00000000002a054 .init_new_context+0x5c/0xf0
[c000000b7096fbc0] c000000000049dc8 .copy_process+0x91c/0x1404
[c000000b7096fcd0] c00000000004a988 .do_fork+0xd8/0x224
[c000000b7096fdc0] c00000000000ebdc .sys_clone+0x5c/0x74
[c000000b7096fe30] c000000000008950 .ppc_clone+0x8/0xc
Diffstat (limited to 'lib')
-rw-r--r-- | lib/idr.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/lib/idr.c b/lib/idr.c index d226259c3c28..de19030a999b 100644 --- a/lib/idr.c +++ b/lib/idr.c @@ -48,15 +48,21 @@ static struct idr_layer *alloc_layer(struct idr *idp) return(p); } +/* only called when idp->lock is held */ +static void __free_layer(struct idr *idp, struct idr_layer *p) +{ + p->ary[0] = idp->id_free; + idp->id_free = p; + idp->id_free_cnt++; +} + static void free_layer(struct idr *idp, struct idr_layer *p) { /* * Depends on the return element being zeroed. */ spin_lock(&idp->lock); - p->ary[0] = idp->id_free; - idp->id_free = p; - idp->id_free_cnt++; + __free_layer(idp, p); spin_unlock(&idp->lock); } @@ -184,12 +190,14 @@ build_up: * The allocation failed. If we built part of * the structure tear it down. */ + spin_lock(&idp->lock); for (new = p; p && p != idp->top; new = p) { p = p->ary[0]; new->ary[0] = NULL; new->bitmap = new->count = 0; - free_layer(idp, new); + __free_layer(idp, new); } + spin_unlock(&idp->lock); return -1; } new->ary[0] = p; |