diff options
| author |   Tejun Heo <tj@kernel.org> | 2010-07-02 10:03:51 +0200 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2010-07-02 10:03:51 +0200 |
| commit | 4ce48b37bfedc2bc11e61eae76784887e88b922c (patch) | |
| tree | 0829ba93c3bb5f586bacd11c3f21711b3de04da2 /kernel/workqueue.c | |
| parent | workqueue: use worker_set/clr_flags() only from worker itself (diff) | |
| download | linux-dev-4ce48b37bfedc2bc11e61eae76784887e88b922c.tar.xz linux-dev-4ce48b37bfedc2bc11e61eae76784887e88b922c.zip | |
workqueue: fix race condition in flush_workqueue()
When one flusher is cascading to the next flusher, it first sets
wq->first_flusher to the next one and sets up the next flush cycle.
If there's nothing to do for the next cycle, it clears
wq->flush_flusher and proceeds to the one after that.
If the woken up flusher checks wq->first_flusher before it gets
cleared, it will incorrectly assume the role of the first flusher,
which triggers BUG_ON() sanity check.
Fix it by checking wq->first_flusher again after grabbing the mutex.
Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'kernel/workqueue.c')
| -rw-r--r-- | kernel/workqueue.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 558733801ac0..b59c946433f4 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -2138,6 +2138,10 @@ void flush_workqueue(struct workqueue_struct *wq) mutex_lock(&wq->flush_mutex); + /* we might have raced, check again with mutex held */ + if (wq->first_flusher != &this_flusher) + goto out_unlock; + wq->first_flusher = NULL; BUG_ON(!list_empty(&this_flusher.list)); |