kernel-fxtec-pro1x/drivers/block
Herbert Xu 4b2f0260c7 [PATCH] nbd: fix TX/RX race condition
Janos Haar of First NetCenter Bt.  reported numerous crashes involving the
NBD driver.  With his help, this was tracked down to bogus bio vectors
which in turn was the result of a race condition between the
receive/transmit routines in the NBD driver.

The bug manifests itself like this:

CPU0				CPU1
do_nbd_request
	add req to queuelist
	nbd_send_request
		send req head
		for each bio
			kmap
			send
				nbd_read_stat
					nbd_find_request
					nbd_end_request
			kunmap

When CPU1 finishes nbd_end_request, the request and all its associated
bio's are freed.  So when CPU0 calls kunmap whose argument is derived from
the last bio, it may crash.

Under normal circumstances, the race occurs only on the last bio.  However,
if an error is encountered on the remote NBD server (such as an incorrect
magic number in the request), or if there were a bug in the server, it is
possible for the nbd_end_request to occur any time after the request's
addition to the queuelist.

The following patch fixes this problem by making sure that requests are not
added to the queuelist until after they have been completed transmission.

In order for the receiving side to be ready for responses involving
requests still being transmitted, the patch introduces the concept of the
active request.

When a response matches the current active request, its processing is
delayed until after the tranmission has come to a stop.

This has been tested by Janos and it has been successful in curing this
race condition.

From: Herbert Xu <herbert@gondor.apana.org.au>

  Here is an updated patch which removes the active_req wait in
  nbd_clear_queue and the associated memory barrier.

  I've also clarified this in the comment.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: <djani22@dynamicweb.hu>
Cc: Paul Clements <Paul.Clements@SteelEye.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-01-06 08:33:20 -08:00
..
aoe [BLOCK] aoe: update for combined io statistics 2005-11-01 09:54:23 +01:00
paride [PATCH] fix missing includes 2005-10-30 17:37:32 -08:00
acsi.c [SCSI] remove Scsi_Device typedef 2005-11-09 15:48:20 -05:00
acsi_slm.c [PATCH] timer initialization cleanup: DEFINE_TIMER 2005-09-09 14:03:48 -07:00
amiflop.c [PATCH] changing CONFIG_LOCALVERSION rebuilds too much, for no good reason 2005-11-09 07:55:57 -08:00
ataflop.c [PATCH] timer initialization cleanup: DEFINE_TIMER 2005-09-09 14:03:48 -07:00
cciss.c [PATCH] cciss: fix for deregister_disk 2005-12-12 22:31:16 -08:00
cciss.h [SCSI] cciss: scsi error handling 2005-11-06 14:12:49 -06:00
cciss_cmd.h [PATCH] cciss: direct lookup for command completions 2005-09-13 08:22:30 -07:00
cciss_scsi.c [PATCH] cciss_scsi warning fix 2005-11-15 08:59:20 -08:00
cciss_scsi.h
cpqarray.c
cpqarray.h
cryptoloop.c [CRYPTO]: Use CRYPTO_TFM_REQ_MAY_SLEEP where appropriate 2005-09-01 17:43:25 -07:00
DAC960.c [PATCH] kfree cleanup: misc remaining drivers 2005-11-07 07:54:05 -08:00
DAC960.h [PATCH] DAC960: add support for Mylex AcceleRAID 4/5/600 2005-05-05 16:36:43 -07:00
floppy.c [PATCH] revert floppy-fix-read-only-handling 2005-11-23 16:08:38 -08:00
ida_cmd.h
ida_ioctl.h
Kconfig [PATCH] USB: drivers/usb/storage/libusual 2006-01-04 13:48:31 -08:00
loop.c [PATCH] add AOP_TRUNCATED_PAGE, prepend AOP_ to WRITEPAGE_ACTIVATE 2006-01-03 11:45:42 -08:00
Makefile [BLOCK] Move all core block layer code to new block/ directory 2005-11-04 08:43:35 +01:00
nbd.c [PATCH] nbd: fix TX/RX race condition 2006-01-06 08:33:20 -08:00
pktcdvd.c [PATCH] packet writing oops fix 2005-11-13 18:14:11 -08:00
ps2esdi.c [PATCH] timer initialization cleanup: DEFINE_TIMER 2005-09-09 14:03:48 -07:00
rd.c [PATCH] add AOP_TRUNCATED_PAGE, prepend AOP_ to WRITEPAGE_ACTIVATE 2006-01-03 11:45:42 -08:00
smart1,2.h
swim3.c powermac: Use a spinlock in swim3.c (floppy driver) instead of cli 2005-11-08 12:15:36 +11:00
swim_iop.c [PATCH] drivers/block: fix-up schedule_timeout() usage 2005-09-10 10:06:38 -07:00
sx8.c drivers/block/sx8: kill unused variable 2005-10-22 01:33:18 -04:00
ub.c [PATCH] USB: ub 02 Removed unused variable 2006-01-04 13:51:44 -08:00
umem.c [PATCH] janitor: block/umem: replace PRINTK with pr_debug 2005-09-10 10:06:33 -07:00
viodasd.c merge filename and modify references to iseries/vio.h 2005-11-02 15:13:57 +11:00
xd.c [PATCH] drivers/block: fix-up schedule_timeout() usage 2005-09-10 10:06:38 -07:00
xd.h
z2ram.c [PATCH] vfree and kfree cleanup in drivers/ 2005-09-10 10:06:30 -07:00