summaryrefslogtreecommitdiff
path: root/net/rxrpc/ar-output.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2016-03-04 18:58:06 +0300
committerDavid Howells <dhowells@redhat.com>2016-03-04 18:58:06 +0300
commitee72b9fddb41a2087b4a7aa74791ef1700f3f6cc (patch)
tree36725c70bc83ff45d66bdb4f7b3377d09722e4e7 /net/rxrpc/ar-output.c
parentb4f1342f915201ee15ef6890857b5469879ee402 (diff)
downloadlinux-ee72b9fddb41a2087b4a7aa74791ef1700f3f6cc.tar.xz
rxrpc: Use ACCESS_ONCE() when accessing circular buffer pointers
Use ACCESS_ONCE() when accessing the other-end pointer into a circular buffer as it's possible the other-end pointer might change whilst we're doing this, and if we access it twice, we might get some weird things happening. Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'net/rxrpc/ar-output.c')
-rw-r--r--net/rxrpc/ar-output.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
index 353f5c9141ea..14c8df6b7f41 100644
--- a/net/rxrpc/ar-output.c
+++ b/net/rxrpc/ar-output.c
@@ -401,7 +401,8 @@ static int rxrpc_wait_for_tx_window(struct rxrpc_sock *rx,
int ret;
_enter(",{%d},%ld",
- CIRC_SPACE(call->acks_head, call->acks_tail, call->acks_winsz),
+ CIRC_SPACE(call->acks_head, ACCESS_ONCE(call->acks_tail),
+ call->acks_winsz),
*timeo);
add_wait_queue(&call->tx_waitq, &myself);
@@ -409,7 +410,7 @@ static int rxrpc_wait_for_tx_window(struct rxrpc_sock *rx,
for (;;) {
set_current_state(TASK_INTERRUPTIBLE);
ret = 0;
- if (CIRC_SPACE(call->acks_head, call->acks_tail,
+ if (CIRC_SPACE(call->acks_head, ACCESS_ONCE(call->acks_tail),
call->acks_winsz) > 0)
break;
if (signal_pending(current)) {
@@ -570,7 +571,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
_debug("alloc");
- if (CIRC_SPACE(call->acks_head, call->acks_tail,
+ if (CIRC_SPACE(call->acks_head,
+ ACCESS_ONCE(call->acks_tail),
call->acks_winsz) <= 0) {
ret = -EAGAIN;
if (msg->msg_flags & MSG_DONTWAIT)
@@ -686,7 +688,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
sp->hdr.flags = conn->out_clientflag;
if (msg_data_left(msg) == 0 && !more)
sp->hdr.flags |= RXRPC_LAST_PACKET;
- else if (CIRC_SPACE(call->acks_head, call->acks_tail,
+ else if (CIRC_SPACE(call->acks_head,
+ ACCESS_ONCE(call->acks_tail),
call->acks_winsz) > 1)
sp->hdr.flags |= RXRPC_MORE_PACKETS;
if (more && seq & 1)