Fix rcu list poisoning - since another CPU may be traversing the list

as we delete the entry, we can only poison the back pointer, not the
traversal pointer (rcu traversal only ever walks forward).

Make __d_drop() take this into account.

diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 72ce83dd69e52dcb207ed98dcb43a35037d90047..1442779bd8935247852fc9135186aa47b07dd770 100644 (file)
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -174,8 +174,10 @@ extern spinlock_t dcache_lock;
 
 static inline void __d_drop(struct dentry *dentry)
 {
-       dentry->d_vfs_flags |= DCACHE_UNHASHED;
-       hlist_del_rcu_init(&dentry->d_hash);
+       if (!(dentry->d_vfs_flags & DCACHE_UNHASHED)) {
+               dentry->d_vfs_flags |= DCACHE_UNHASHED;
+               hlist_del_rcu(&dentry->d_hash);
+       }
 }
 
 static inline void d_drop(struct dentry *dentry)

diff --git a/include/linux/list.h b/include/linux/list.h
index eed55ea5860a315208338c6994f17369148144a4..ff4109f01a7235a9c872dca46f62f4fd844796f3 100644 (file)
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -152,14 +152,17 @@ static inline void list_del(struct list_head *entry)
 /**
  * list_del_rcu - deletes entry from list without re-initialization
  * @entry: the element to delete from the list.
+ *
  * Note: list_empty on entry does not return true after this, 
  * the entry is in an undefined state. It is useful for RCU based
  * lockfree traversal.
+ *
+ * In particular, it means that we can not poison the forward 
+ * pointers that may still be used for walking the list.
  */
 static inline void list_del_rcu(struct list_head *entry)
 {
        __list_del(entry->prev, entry->next);
-       entry->next = LIST_POISON1;
        entry->prev = LIST_POISON2;
 }
 
@@ -431,7 +434,22 @@ static __inline__ void hlist_del(struct hlist_node *n)
        n->pprev = LIST_POISON2;
 }
 
-#define hlist_del_rcu hlist_del  /* list_del_rcu is identical too? */
+/**
+ * hlist_del_rcu - deletes entry from hash list without re-initialization
+ * @entry: the element to delete from the hash list.
+ *
+ * Note: list_unhashed() on entry does not return true after this, 
+ * the entry is in an undefined state. It is useful for RCU based
+ * lockfree traversal.
+ *
+ * In particular, it means that we can not poison the forward
+ * pointers that may still be used for walking the hash list.
+ */
+static inline void hlist_del_rcu(struct hlist_node *n)
+{
+       __hlist_del(n);
+       n->pprev = LIST_POISON2;
+}
 
 static __inline__ void hlist_del_init(struct hlist_node *n) 
 {