RPC: killing RPC tasks races fixed

Stanislav Kinsbursky · Trond Myklebust · commit 8e26de238fd7 · 2011-03-17T12:39:00.000-04:00
RPC task RPC_TASK_QUEUED bit is set must be checked before trying to wake up
task rpc_killall_tasks() because task-&gt;tk_waitqueue can not be set (equal to
NULL).
Also, as Trond Myklebust mentioned, such approach (instead of checking
tk_waitqueue to NULL) allows us to "optimise away the call to
rpc_wake_up_queued_task() altogether for those
tasks that aren't queued".

Here is an example of dereferencing of tk_waitqueue equal to NULL:

CPU 0               	CPU 1				CPU 2
--------------------	---------------------	--------------------------
nfs4_run_open_task
rpc_run_task
rpc_execute
rpc_set_active
rpc_make_runnable
(waiting)
			rpc_async_schedule
			nfs4_open_prepare
			nfs_wait_on_sequence
						nfs_umount_begin
						rpc_killall_tasks
						rpc_wake_up_task
						rpc_wake_up_queued_task
						spin_lock(tk_waitqueue == NULL)
						BUG()
			rpc_sleep_on
			spin_lock(&amp;q-&gt;lock)
			__rpc_sleep_on
			task-&gt;tk_waitqueue = q

Signed-off-by: Stanislav Kinsbursky &lt;skinsbursky@openvz.org&gt;
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust &lt;Trond.Myklebust@netapp.com&gt;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
@@ -436,7 +436,9 @@ void rpc_killall_tasks(struct rpc_clnt *clnt)
 		if (!(rovr->tk_flags & RPC_TASK_KILLED)) {
 			rovr->tk_flags |= RPC_TASK_KILLED;
 			rpc_exit(rovr, -EIO);
-			rpc_wake_up_queued_task(rovr->tk_waitqueue, rovr);
+			if (RPC_IS_QUEUED(rovr))
+				rpc_wake_up_queued_task(rovr->tk_waitqueue,
+							rovr);
 		}
 	}
 	spin_unlock(&clnt->cl_lock);

Original file line number	Diff line number	Diff line change
`@@ -436,7 +436,9 @@ void rpc_killall_tasks(struct rpc_clnt *clnt)`
`436`	`436`	`if (!(rovr->tk_flags & RPC_TASK_KILLED)) {`
`437`	`437`	`rovr->tk_flags \|= RPC_TASK_KILLED;`
`438`	`438`	`rpc_exit(rovr, -EIO);`
`439`		`- rpc_wake_up_queued_task(rovr->tk_waitqueue, rovr);`
	`439`	`+ if (RPC_IS_QUEUED(rovr))`
	`440`	`+ rpc_wake_up_queued_task(rovr->tk_waitqueue,`
	`441`	`+ rovr);`
`440`	`442`	`}`
`441`	`443`	`}`
`442`	`444`	`spin_unlock(&clnt->cl_lock);`