[PATCH] ieee1394: sbp2: fix race condition in state change

[PATCH] ieee1394: sbp2: fix race condition in state change

[Stefan Richter]

An intermediate transition from _RUNNING to _IN_SHUTDOWN could have been
missed by the former code.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
---
 drivers/ieee1394/sbp2.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Index: linux/drivers/ieee1394/sbp2.c
===================================================================
--- linux.orig/drivers/ieee1394/sbp2.c
+++ linux/drivers/ieee1394/sbp2.c
@@ -895,12 +895,13 @@ static void sbp2_host_reset(struct hpsb_
 		return;
 
 	read_lock_irqsave(&sbp2_hi_logical_units_lock, flags);
+
 	list_for_each_entry(lu, &hi->logical_units, lu_list)
-		if (likely(atomic_read(&lu->state) !=
-			   SBP2LU_STATE_IN_SHUTDOWN)) {
-			atomic_set(&lu->state, SBP2LU_STATE_IN_RESET);
+		if (atomic_cmpxchg(&lu->state,
+				   SBP2LU_STATE_RUNNING, SBP2LU_STATE_IN_RESET)
+		    == SBP2LU_STATE_RUNNING)
 			scsi_block_requests(lu->shost);
-		}
+
 	read_unlock_irqrestore(&sbp2_hi_logical_units_lock, flags);
 }
 

-- 
Stefan Richter
-=====-==--- =-== ===-=
http://arcgraph.de/sr/

Re: [PATCH] ieee1394: sbp2: fix race condition in state change

[Stefan Richter]

I wrote:
> An intermediate transition from _RUNNING to _IN_SHUTDOWN could have been
> missed by the former code.
> 
> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
> ---
>  drivers/ieee1394/sbp2.c |    9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> Index: linux/drivers/ieee1394/sbp2.c
> ===================================================================
> --- linux.orig/drivers/ieee1394/sbp2.c
> +++ linux/drivers/ieee1394/sbp2.c
> @@ -895,12 +895,13 @@ static void sbp2_host_reset(struct hpsb_
>  		return;
>  
>  	read_lock_irqsave(&sbp2_hi_logical_units_lock, flags);
> +
>  	list_for_each_entry(lu, &hi->logical_units, lu_list)
> -		if (likely(atomic_read(&lu->state) !=
> -			   SBP2LU_STATE_IN_SHUTDOWN)) {
> -			atomic_set(&lu->state, SBP2LU_STATE_IN_RESET);
> +		if (atomic_cmpxchg(&lu->state,
> +				   SBP2LU_STATE_RUNNING, SBP2LU_STATE_IN_RESET)
> +		    == SBP2LU_STATE_RUNNING)
>  			scsi_block_requests(lu->shost);
> -		}
> +
>  	read_unlock_irqrestore(&sbp2_hi_logical_units_lock, flags);
>  }
>  

Still not entirely correct.  Maybe

		scsi_block_requests(lu->shost);
		if (atomic_cmpxchg(&lu->state,
				   SBP2LU_STATE_RUNNING,
				   SBP2LU_STATE_IN_RESET)
		    == SBP2LU_IN_SHUTDOWN)
			scsi_unblock_requests(lu->shost);

Does What I Mean.  Or I should just put a lock around all lu->state and
shost->host_self_blocked manipulations.
-- 
Stefan Richter
-=====-==--- ==-- ----=
http://arcgraph.de/sr/