Driver core: Don't call put methods while holding a spinlock
The klist utility routines currently call _put methods while holding a
spinlock. This is of course illegal; a put routine could try to
unregister a device and hence need to sleep.
No problems have arisen until now because in many cases klist removals
were done synchronously, so the _put methods were never actually used.
In other cases we may simply have been lucky.
This patch (as784) reworks the klist routines so that _put methods are
called only _after_ the klist's spinlock has been released.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/lib/klist.c b/lib/klist.c
index 9c94f0b..120bd17 100644
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -123,12 +123,10 @@
static void klist_release(struct kref * kref)
{
struct klist_node * n = container_of(kref, struct klist_node, n_ref);
- void (*put)(struct klist_node *) = n->n_klist->put;
+
list_del(&n->n_node);
complete(&n->n_removed);
n->n_klist = NULL;
- if (put)
- put(n);
}
static int klist_dec_and_del(struct klist_node * n)
@@ -145,10 +143,14 @@
void klist_del(struct klist_node * n)
{
struct klist * k = n->n_klist;
+ void (*put)(struct klist_node *) = k->put;
spin_lock(&k->k_lock);
- klist_dec_and_del(n);
+ if (!klist_dec_and_del(n))
+ put = NULL;
spin_unlock(&k->k_lock);
+ if (put)
+ put(n);
}
EXPORT_SYMBOL_GPL(klist_del);
@@ -161,10 +163,7 @@
void klist_remove(struct klist_node * n)
{
- struct klist * k = n->n_klist;
- spin_lock(&k->k_lock);
- klist_dec_and_del(n);
- spin_unlock(&k->k_lock);
+ klist_del(n);
wait_for_completion(&n->n_removed);
}
@@ -260,12 +259,15 @@
struct klist_node * klist_next(struct klist_iter * i)
{
struct list_head * next;
+ struct klist_node * lnode = i->i_cur;
struct klist_node * knode = NULL;
+ void (*put)(struct klist_node *) = i->i_klist->put;
spin_lock(&i->i_klist->k_lock);
- if (i->i_cur) {
- next = i->i_cur->n_node.next;
- klist_dec_and_del(i->i_cur);
+ if (lnode) {
+ next = lnode->n_node.next;
+ if (!klist_dec_and_del(lnode))
+ put = NULL;
} else
next = i->i_head->next;
@@ -275,6 +277,8 @@
}
i->i_cur = knode;
spin_unlock(&i->i_klist->k_lock);
+ if (put && lnode)
+ put(lnode);
return knode;
}