inet: frags: Remove unnecessary smp_store_release/READ_ONCE (32707c4d) · Commits · 戴 / test

The smp_store_release call in fqdir_exit cannot protect the setting of fqdir->dead as claimed because its memory barrier is only guaranteed to be one-way and the barrier precedes the setting of fqdir->dead. IOW it doesn't provide any barriers between fq->dir and the following hash table destruction. In fact, the code is safe anyway because call_rcu does provide both the memory barrier as well as a guarantee that when the destruction work starts executing all RCU readers will see the updated value for fqdir->dead. Therefore this patch removes the unnecessary smp_store_release call as well as the corresponding READ_ONCE on the read-side in order to not confuse future readers of this code. Comments have been added in their places. Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by:

Eric Dumazet <edumazet@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/inet_fragment.c

+10 −6

Original line number	Diff line number	Diff line
		@@ -193,10 +193,12 @@ void fqdir_exit(struct fqdir *fqdir)
		{
		fqdir->high_thresh = 0; /* prevent creation of new frags */

		/* paired with READ_ONCE() in inet_frag_kill() :
		* We want to prevent rhashtable_remove_fast() calls
		fqdir->dead = true;

		/* call_rcu is supposed to provide memory barrier semantics,
		* separating the setting of fqdir->dead with the destruction
		* work. This implicit barrier is paired with inet_frag_kill().
		*/
		smp_store_release(&fqdir->dead, true);

		INIT_RCU_WORK(&fqdir->destroy_rwork, fqdir_rwork_fn);
		queue_rcu_work(system_wq, &fqdir->destroy_rwork);
		@@ -214,10 +216,12 @@ void inet_frag_kill(struct inet_frag_queue *fq)

		fq->flags \|= INET_FRAG_COMPLETE;
		rcu_read_lock();
		/* This READ_ONCE() is paired with smp_store_release()
		* in inet_frags_exit_net().
		/* The RCU read lock provides a memory barrier
		* guaranteeing that if fqdir->dead is false then
		* the hash table destruction will not start until
		* after we unlock. Paired with inet_frags_exit_net().
		*/
		if (!READ_ONCE(fqdir->dead)) {
		if (!fqdir->dead) {
		rhashtable_remove_fast(&fqdir->rhashtable, &fq->node,
		fqdir->f->rhash_params);
		refcount_dec(&fq->refcnt);

Admin message