[PATCH] 2.6.8.1 MegaRAID Driver Race

[PATCH] 2.6.8.1 MegaRAID Driver Race

[bradgoodman.com]

[PATCH] 2.6.8.1 to LSI Logic MegaRAID Adapter - ioctl function calls 
mega_internal_command, which uses wait_event, which calls schedule.
This means schedule() is called while big kernel_lock is held.

Locks/Unlocks were done here because 

1. There are a lot of return()s in the ioctl function to dodge.
2. mega_internal_command is also called by read and writes,
   which don't hold big kernel_lock

Brad Goodman <brad@bradgoodman.com>


--- drivers/scsi/megaraid.c.orig	Mon Aug 23 15:57:09 2004
+++ drivers/scsi/megaraid.c	Mon Aug 23 15:18:48 2004
@@ -38,6 +38,7 @@
 #include <linux/blkdev.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
+#include <linux/smp_lock.h>
 #include <linux/delay.h>
 #include <linux/proc_fs.h>
 #include <linux/reboot.h>
@@ -3622,7 +3623,9 @@
 			/*
 			 * Issue the command
 			 */
+			unlock_kernel();
 			mega_internal_command(adapter, LOCK_INT, &mc, pthru);
+			lock_kernel();
 
 			rval = mega_n_to_m((void __user *)arg, &mc);
 
@@ -3705,7 +3708,9 @@
 			/*
 			 * Issue the command
 			 */
+			unlock_kernel();
 			mega_internal_command(adapter, LOCK_INT, &mc, NULL);
+			lock_kernel();
 
 			rval = mega_n_to_m((void __user *)arg, &mc);
 

Re: [PATCH] 2.6.8.1 MegaRAID Driver Race

[Andrew Morton]

"bradgoodman.com" <bkgoodman@bradgoodman.com> wrote:
>
> [PATCH] 2.6.8.1 to LSI Logic MegaRAID Adapter - ioctl function calls 
> mega_internal_command, which uses wait_event, which calls schedule.
> This means schedule() is called while big kernel_lock is held.
> 
> Locks/Unlocks were done here because 
> 
> 1. There are a lot of return()s in the ioctl function to dodge.
> 2. mega_internal_command is also called by read and writes,
>    which don't hold big kernel_lock

Calling schedule() inside lock_kernel() is legal.

It may, however, be wrong within the context of the particular caller
because schedule() will drop the lock.  So new races might have been
introduced.

Re: [PATCH] 2.6.8.1 MegaRAID Driver Race

[Alan Cox]

On Llu, 2004-08-23 at 22:57, bradgoodman.com wrote:
> [PATCH] 2.6.8.1 to LSI Logic MegaRAID Adapter - ioctl function calls 
> mega_internal_command, which uses wait_event, which calls schedule.
> This means schedule() is called while big kernel_lock is held.

This is allowed. The bkl is dropped and regained across sleeps. Its a
lock that gives "traditional unix semantics" not a normal lock.