irq/work: Use llist_for_each_entry_safe (d00a08cf) · Commits · 戴 / test

The llist_for_each_entry() loop in irq_work_run_list() is unsafe because once the works PENDING bit is cleared it can be requeued on another CPU. Use llist_for_each_entry_safe() instead. Fixes: ("irq/work: Don't reinvent the wheel but use existing llist API") Reported-by:

Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by:

Thomas Gleixner <tglx@linutronix.de> Cc: Frederic Weisbecker <frederic@kernel.org> Cc: Byungchul Park <byungchul.park@lge.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Petri Latvala <petri.latvala@intel.com> Link: http://lkml.kernel.org/r/151027307351.14762.4611888896020658384@mail.alporthouse.com

kernel/irq_work.c

+3 −3

Original line number	Original line	Diff line number	Diff line
	@@ -128,9 +128,9 @@ bool irq_work_needs_cpu(void)

	static void irq_work_run_list(struct llist_head *list)		static void irq_work_run_list(struct llist_head *list)
	{		{
	unsigned long flags;		struct irq_work work, tmp;
	struct irq_work *work;
	struct llist_node *llnode;		struct llist_node *llnode;
			unsigned long flags;

	BUG_ON(!irqs_disabled());		BUG_ON(!irqs_disabled());

	@@ -138,7 +138,7 @@ static void irq_work_run_list(struct llist_head *list)
	return;		return;

	llnode = llist_del_all(list);		llnode = llist_del_all(list);
	llist_for_each_entry(work, llnode, llnode) {		llist_for_each_entry_safe(work, tmp, llnode, llnode) {
	/*		/*
	* Clear the PENDING bit, after this point the @work		* Clear the PENDING bit, after this point the @work
	* can be re-used.		* can be re-used.

Admin message