summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJan Stancek <jstancek@redhat.com>2019-12-22 15:33:24 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2019-12-22 20:47:47 +0300
commit0dd1e3773ae8afc4bfdce782bdeffc10f9cae6ec (patch)
tree65b6d77c5be91eb0104945af6598bf8d9718426e
parentb8e382a185ebb1bca66bd541e5a0f858b6b9cbb9 (diff)
downloadlinux-0dd1e3773ae8afc4bfdce782bdeffc10f9cae6ec.tar.xz
pipe: fix empty pipe check in pipe_write()
LTP pipeio_1 test is hanging with v5.5-rc2-385-gb8e382a185eb, with read side observing empty pipe and sleeping and write side running out of space and then sleeping as well. In this scenario there are 5 writers and 1 reader. Problem is that after pipe_write() reacquires pipe lock, it re-checks for empty pipe with potentially stale 'head' and doesn't wake up read side anymore. pipe->tail can advance beyond 'head', because there are multiple writers. Use pipe->head for empty pipe check after reacquiring lock to observe current state. Testing: With patch, LTP pipeio_1 ran successfully in loop for 1 hour. Without patch it hanged within a minute. Fixes: 1b6b26ae7053 ("pipe: fix and clarify pipe write wakeup logic") Reported-by: Rachel Sibley <rasibley@redhat.com> Signed-off-by: Jan Stancek <jstancek@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--fs/pipe.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/pipe.c b/fs/pipe.c
index 04d004ee2e8c..57502c3c0fba 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -581,7 +581,7 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
}
wait_event_interruptible(pipe->wait, pipe_writable(pipe));
__pipe_lock(pipe);
- was_empty = pipe_empty(head, pipe->tail);
+ was_empty = pipe_empty(pipe->head, pipe->tail);
}
out:
__pipe_unlock(pipe);