[lkml]   [2001]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] fix for cdput() race
	Resend - that area hadn't changed and bug is still there.

Race between cdput() and cdget() - if we have the only reference to
char_device and call cdput() while somebody else does cdget() on
another CPU, we are going to hit a race:

grabs cdev_lock
searches the lists
decrements ->count to 0
spins on attempt to get cdev_lock
find the structure
increments ->count
drops cdev_lock
returns pointer to found acquires cdev_lock
removes the structure from lists
frees it
caller of cdget:
dereferences the returned value

This is exactly the same scenario as we had in d_lookup()/dput() - one
that lead to introduction of atomic_dec_and_lock(). Fix is trivial.
Please, apply.

--- linux/fs/char_dev.c Thu May 24 18:26:45 2001
+++ /tmp/char_dev.c Mon Oct 29 13:43:41 2001
@@ -104,8 +104,7 @@

void cdput(struct char_device *cdev)
- if (atomic_dec_and_test(&cdev->count)) {
- spin_lock(&cdev_lock);
+ if (atomic_dec_and_lock(&cdev->count, &cdev_lock)) {
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:12    [W:0.024 / U:0.432 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site