[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux1394-devel
Subject:    fw_core_remove_address_handler races?
From:       Stefan Richter <stefanr () s5r6 ! in-berlin ! de>
Date:       2012-02-18 14:42:23
Message-ID: 20120218154223.6c6c62a0 () stein
[Download RAW message or body]

Hi,

talking with Chris about sbp-target on irc I am beginning to wonder whether
our current fw_core_remove_address_handler() callers are safe.

On exit, fw_core_remove_address_handler() guarantees that the handler is
not going to be called anymore.  But it does not guarantee that the
handler is not running anymore.

Example user #1, drivers/firewire/sbp2.c::sbp2_remove():

		if (lu->login_id != INVALID_LOGIN_ID) {
[...]
			sbp2_send_management_orb(lu, node_id, generation,
						 SBP2_LOGOUT_REQUEST,
						 lu->login_id, NULL);
		}
		fw_core_remove_address_handler(&lu->address_handler);
		list_del(&lu->link);
		kfree(lu);

So sbp2_send_management_orb() blocks until logout status was written.
Fine, but it actually waits with a time-out, and besides, what stops a
devious target to write unsolicited status?

Example user #2, sound/firewire/fcp.c:

static void __exit fcp_module_exit(void)
{
	WARN_ON(!list_empty(&transactions));
	fw_core_remove_address_handler(&response_register_handler);
}

Wouldn't this blow up if the module is unloaded by one CPU while the
sound/firewire/fcp.c::fcp_response() tasklet is running on another CPU?
Even if all FCP transactions had been completed at that time (so at least
the WARN_ON would not complain), there could have been an unsolicited
FCP_RESPONSE gone in and being handled.

So right now it seems to me that fw_core_remove_address_handler() should
be extended to additionally guarantee on exit that the handler is not being
executed on another CPU.
-- 
Stefan Richter
-=====-===-- --=- =--=-
http://arcgraph.de/sr/

------------------------------------------------------------------------------
Virtualization & Cloud Management Using Capacity Planning
Cloud computing makes use of virtualization - but cloud computing 
also focuses on allowing computing to be delivered as a service.
http://www.accelacomm.com/jaw/sfnl/114/51521223/
_______________________________________________
mailing list linux1394-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux1394-devel
[prev in list] [next in list] [prev in thread] [next in thread]