Test and set xbdi->xbdi_cont at splbio(). Otherwise we could overwrite

xbdi->xbdi_cont and process the same request twice.
This commit is contained in:
bouyer 2011-03-05 15:12:16 +00:00
parent 8d7cb782a7
commit 0ccdc9a448
1 changed files with 5 additions and 2 deletions

View File

@ -1,4 +1,4 @@
/* $NetBSD: xbdback_xenbus.c,v 1.32 2010/06/24 13:03:06 hannken Exp $ */ /* $NetBSD: xbdback_xenbus.c,v 1.33 2011/03/05 15:12:16 bouyer Exp $ */
/* /*
* Copyright (c) 2006 Manuel Bouyer. * Copyright (c) 2006 Manuel Bouyer.
@ -26,7 +26,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: xbdback_xenbus.c,v 1.32 2010/06/24 13:03:06 hannken Exp $"); __KERNEL_RCSID(0, "$NetBSD: xbdback_xenbus.c,v 1.33 2011/03/05 15:12:16 bouyer Exp $");
#include <sys/types.h> #include <sys/types.h>
#include <sys/param.h> #include <sys/param.h>
@ -1370,6 +1370,7 @@ xbdback_iodone(struct buf *bp)
struct xbdback_io *xbd_io; struct xbdback_io *xbd_io;
struct xbdback_instance *xbdi; struct xbdback_instance *xbdi;
int errp; int errp;
int s;
xbd_io = bp->b_private; xbd_io = bp->b_private;
xbdi = xbd_io->xio_xbdi; xbdi = xbd_io->xio_xbdi;
@ -1424,11 +1425,13 @@ xbdback_iodone(struct buf *bp)
atomic_dec_uint(&xbdi->xbdi_pendingreqs); atomic_dec_uint(&xbdi->xbdi_pendingreqs);
buf_destroy(&xbd_io->xio_buf); buf_destroy(&xbd_io->xio_buf);
xbdback_pool_put(&xbdback_io_pool, xbd_io); xbdback_pool_put(&xbdback_io_pool, xbd_io);
s = splbio();
if (xbdi->xbdi_cont == NULL) { if (xbdi->xbdi_cont == NULL) {
/* check if there is more work to do */ /* check if there is more work to do */
xbdi->xbdi_cont = xbdback_co_main; xbdi->xbdi_cont = xbdback_co_main;
xbdback_trampoline(xbdi, xbdi); xbdback_trampoline(xbdi, xbdi);
} }
splx(s);
} }
/* /*