mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
sunrpc/cache: ensure items removed from cache do not have pending upcalls.
It is possible for a race to set CACHE_PENDING after cache_clean() has removed a cache entry from the cache. If CACHE_PENDING is still set when the entry is finally 'put', the cache_dequeue() will never happen and we can leak memory. So set a new flag 'CACHE_CLEANED' when we remove something from the cache, and don't queue any upcall if it is set. If CACHE_PENDING is set before CACHE_CLEANED, the call that cache_clean() makes to cache_fresh_unlocked() will free memory as needed. If CACHE_PENDING is set after CACHE_CLEANED, the test in sunrpc_cache_pipe_upcall will ensure that the memory is not allocated. Reported-by: <bstroesser@ts.fujitsu.com> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
This commit is contained in:
parent
2a1c7f53fd
commit
013920eb5d
|
@ -57,6 +57,7 @@ struct cache_head {
|
|||
#define CACHE_VALID 0 /* Entry contains valid data */
|
||||
#define CACHE_NEGATIVE 1 /* Negative entry - there is no match for the key */
|
||||
#define CACHE_PENDING 2 /* An upcall has been sent but no reply received yet*/
|
||||
#define CACHE_CLEANED 3 /* Entry has been cleaned from cache */
|
||||
|
||||
#define CACHE_NEW_EXPIRY 120 /* keep new things pending confirmation for 120 seconds */
|
||||
|
||||
|
|
|
@ -306,7 +306,7 @@ EXPORT_SYMBOL_GPL(cache_check);
|
|||
* a current pointer into that list and into the table
|
||||
* for that entry.
|
||||
*
|
||||
* Each time clean_cache is called it finds the next non-empty entry
|
||||
* Each time cache_clean is called it finds the next non-empty entry
|
||||
* in the current table and walks the list in that entry
|
||||
* looking for entries that can be removed.
|
||||
*
|
||||
|
@ -453,6 +453,7 @@ static int cache_clean(void)
|
|||
current_index ++;
|
||||
spin_unlock(&cache_list_lock);
|
||||
if (ch) {
|
||||
set_bit(CACHE_CLEANED, &ch->flags);
|
||||
cache_fresh_unlocked(ch, d);
|
||||
cache_put(ch, d);
|
||||
}
|
||||
|
@ -1178,6 +1179,9 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
|
|||
warn_no_listener(detail);
|
||||
return -EINVAL;
|
||||
}
|
||||
if (test_bit(CACHE_CLEANED, &h->flags))
|
||||
/* Too late to make an upcall */
|
||||
return -EAGAIN;
|
||||
|
||||
buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
|
||||
if (!buf)
|
||||
|
|
Loading…
Reference in a new issue