Messages in this thread | | | Date | Tue, 05 Aug 2003 20:51:22 -0400 | From | Paul Clements <> | Subject | Re: [PATCH] 2.6.0 NBD driver: remove send/recieve race for request |
| |
Lou Langholtz wrote: > > Paul Clements wrote: > > >Lou Langholtz wrote: > > > > > >>The following patch removes a race condition in the network block device > >>driver in 2.6.0*. Without this patch, the reply receiving thread could > >>end (and free up the memory for) the request structure before the > >>request sending thread is completely done accessing it and would then > >>access invalid memory. > >> > >> > > > >Indeed, there is a race condition here. It's a very small window, but it > >looks like it could possibly be trouble on SMP/preempt kernels. > > > >This patch looks OK, but it appears to still leave the race window open > >in the error case (it seems to fix the non-error case, though). We > >probably could actually use the ref_count field of struct request to > >better fix this problem. I'll take a look at doing this, and send a > >patch out in a while. > > > >Thanks, > >Paul > > > > > Except that in the error case, the send basically didn't succeed. So no > need to worry about recieving a reply and no race possibility in that case.
As long as the request is on the queue, it is possible for nbd-client to die, thus freeing the request (via nbd_clear_que -> nbd_end_request), and leaving us with a race between the free and do_nbd_request() accessing the request structure.
-- Paul - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |