[PATCH net] rxrpc: fix a race in rxrpc_exit_net()

David Howells dhowells at redhat.com
Thu Apr 7 23:41:30 PDT 2022


Hi Eric,

[Note that your patch is appl/octet-stream for some reason.]

> 	rxnet->live = false;
> -	del_timer_sync(&rxnet->peer_keepalive_timer);
>  	cancel_work_sync(&rxnet->peer_keepalive_work);
> +	del_timer_sync(&rxnet->peer_keepalive_timer);

That fixes that problem, but introduces another.  The timer could be in the
throes of queueing the worker:

	CPU 1			CPU 2
	====================	=====================
				if (rxnet->live)
				<INTERRUPT>
	rxnet->live = false;
 	cancel_work_sync(&rxnet->peer_keepalive_work);
				rxrpc_queue_work(&rxnet->peer_keepalive_work);
	del_timer_sync(&rxnet->peer_keepalive_timer);

I think keeping the first del_timer_sync() that you removed and the one after
the cancel would be sufficient.

David




More information about the linux-afs mailing list