padata: Fix race in the serialization path

klassert · herbertx · commit 3047817b894d · 2012-03-14T17:25:56.000+08:00
When a padata object is queued to the serialization queue, another
cpu might process and free the padata object. So don't dereference
it after queueing to the serialization queue.

Signed-off-by: Steffen Klassert &lt;steffen.klassert@secunet.com&gt;
Signed-off-by: Herbert Xu &lt;herbert@gondor.apana.org.au&gt;
diff --git a/kernel/padata.c b/kernel/padata.c
@@ -230,6 +230,7 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd)
 
 static void padata_reorder(struct parallel_data *pd)
 {
+	int cb_cpu;
 	struct padata_priv *padata;
 	struct padata_serial_queue *squeue;
 	struct padata_instance *pinst = pd->pinst;
@@ -270,13 +271,14 @@ static void padata_reorder(struct parallel_data *pd)
 			return;
 		}
 
-		squeue = per_cpu_ptr(pd->squeue, padata->cb_cpu);
+		cb_cpu = padata->cb_cpu;
+		squeue = per_cpu_ptr(pd->squeue, cb_cpu);
 
 		spin_lock(&squeue->serial.lock);
 		list_add_tail(&padata->list, &squeue->serial.list);
 		spin_unlock(&squeue->serial.lock);
 
-		queue_work_on(padata->cb_cpu, pinst->wq, &squeue->work);
+		queue_work_on(cb_cpu, pinst->wq, &squeue->work);
 	}
 
 	spin_unlock_bh(&pd->lock);

Original file line number	Diff line number	Diff line change
`@@ -230,6 +230,7 @@ static struct padata_priv padata_get_next(struct parallel_data pd)`
`230`	`230`
`231`	`231`	`static void padata_reorder(struct parallel_data *pd)`
`232`	`232`	`{`
	`233`	`+ int cb_cpu;`
`233`	`234`	`struct padata_priv *padata;`
`234`	`235`	`struct padata_serial_queue *squeue;`
`235`	`236`	`struct padata_instance *pinst = pd->pinst;`
`@@ -270,13 +271,14 @@ static void padata_reorder(struct parallel_data *pd)`
`270`	`271`	`return;`
`271`	`272`	`}`
`272`	`273`
`273`		`- squeue = per_cpu_ptr(pd->squeue, padata->cb_cpu);`
	`274`	`+ cb_cpu = padata->cb_cpu;`
	`275`	`+ squeue = per_cpu_ptr(pd->squeue, cb_cpu);`
`274`	`276`
`275`	`277`	`spin_lock(&squeue->serial.lock);`
`276`	`278`	`list_add_tail(&padata->list, &squeue->serial.list);`
`277`	`279`	`spin_unlock(&squeue->serial.lock);`
`278`	`280`
`279`		`- queue_work_on(padata->cb_cpu, pinst->wq, &squeue->work);`
	`281`	`+ queue_work_on(cb_cpu, pinst->wq, &squeue->work);`
`280`	`282`	`}`
`281`	`283`
`282`	`284`	`spin_unlock_bh(&pd->lock);`