RDS: Fix potential race around rds_i[bw]_allocation
authorAndy Grover <andy.grover@oracle.com>
Fri, 30 Oct 2009 08:51:54 +0000 (08:51 +0000)
committerDavid S. Miller <davem@davemloft.net>
Fri, 30 Oct 2009 22:06:38 +0000 (15:06 -0700)
commit86357b19bcabd9355937f3fb84f90ba9fe76a5d3
treeec9dfe857ce9d5c807b7cce4cd0c831c8e1fcdee
parent244546f0d3101c5441f5b14cfe8a79d62679eaea
RDS: Fix potential race around rds_i[bw]_allocation

"At rds_ib_recv_refill_one(), it first executes atomic_read(&rds_ib_allocation)
for if-condition checking,

and then executes atomic_inc(&rds_ib_allocation) if the condition was
not satisfied.

However, if any other code which updates rds_ib_allocation executes
between these two atomic operation executions,
it seems that it may result race condition. (especially when
rds_ib_allocation + 1 == rds_ib_sysctl_max_recv_allocation)"

This patch fixes this by using atomic_inc_unless to eliminate the
possibility of allocating more than rds_ib_sysctl_max_recv_allocation
and then decrementing the count if the allocation fails. It also
makes an identical change to the iwarp transport.

Reported-by: Shin Hong <hongshin@gmail.com>
Signed-off-by: Andy Grover <andy.grover@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/rds/ib_recv.c
net/rds/iw_recv.c