[PATCH 1/2] blktrace: use cmpxchg

[Andy Isaacson <adi@hexapodia.org>]

Replace open-coded racy implementation of cmpxchg with the real thing.

This bug is probably easy to maliciously trigger from userspace, and
I think it will result in memory corruption, but the race window is
small so I think it's unlikely to be triggered accidentally.

Signed-off-by: Andy Isaacson <adi@hexapodia.org>
---
 kernel/trace/blktrace.c |   14 +++++---------
 1 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 638711c..347fe8e 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -511,11 +511,9 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
 	bt->trace_state = Blktrace_setup;
 
 	ret = -EBUSY;
-	old_bt = xchg(&q->blk_trace, bt);
-	if (old_bt) {
-		(void) xchg(&q->blk_trace, old_bt);
+	old_bt = cmpxchg(&q->blk_trace, NULL, bt);
+	if (old_bt)
 		goto err;
-	}
 
 	if (atomic_inc_return(&blk_probes_ref) == 1)
 		blk_register_tracepoints();
@@ -1464,12 +1462,10 @@ static int blk_trace_setup_queue(struct request_queue *q,
 
 	blk_trace_setup_lba(bt, bdev);
 
-	old_bt = xchg(&q->blk_trace, bt);
-	if (old_bt != NULL) {
-		(void)xchg(&q->blk_trace, old_bt);
-		ret = -EBUSY;
+	ret = -EBUSY;
+	old_bt = cmpxchg(&q->blk_trace, NULL, bt);
+	if (old_bt)
 		goto free_bt;
-	}
 
 	if (atomic_inc_return(&blk_probes_ref) == 1)
 		blk_register_tracepoints();
-- 
1.7.1