diff options
author | Andrew Gallatin <gallatin@FreeBSD.org> | 2020-06-29 21:35:50 +0000 |
---|---|---|
committer | Andrew Gallatin <gallatin@FreeBSD.org> | 2020-06-29 21:35:50 +0000 |
commit | 46cac10b3b54f32739eec1a5093a5acf33f0ac22 (patch) | |
tree | 01ba57471c6ebea200ef3faf134776e2f85be725 /sys/kern/subr_firmware.c | |
parent | bbfbc439f2aa6d4e4e47bb478c7182b2841286e3 (diff) | |
download | src-46cac10b3b54f32739eec1a5093a5acf33f0ac22.tar.gz src-46cac10b3b54f32739eec1a5093a5acf33f0ac22.zip |
Fix a panic when unloading firmware
LIST_FOREACH_SAFE() is not safe in the presence
of other threads removing list entries when a
mutex is released.
This is not in the critical path, so just restart
the scan each time we drop the lock, rather than
using a marker.
Reviewed by: jhb, markj
Sponsored by: Netflix
Notes
Notes:
svn path=/head/; revision=362789
Diffstat (limited to 'sys/kern/subr_firmware.c')
-rw-r--r-- | sys/kern/subr_firmware.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/sys/kern/subr_firmware.c b/sys/kern/subr_firmware.c index df0f2558bbdb..db262c121918 100644 --- a/sys/kern/subr_firmware.c +++ b/sys/kern/subr_firmware.c @@ -394,14 +394,12 @@ EVENTHANDLER_DEFINE(mountroot, firmware_mountroot, NULL, 0); static void unloadentry(void *unused1, int unused2) { - struct priv_fw *fp, *tmp; + struct priv_fw *fp; int err; - bool changed; mtx_lock(&firmware_mtx); - changed = false; restart: - LIST_FOREACH_SAFE(fp, &firmware_table, link, tmp) { + LIST_FOREACH(fp, &firmware_table, link) { if (fp->file == NULL || fp->refcnt != 0 || (fp->flags & FW_UNLOAD) == 0) continue; @@ -412,7 +410,6 @@ restart: * 2. clear FW_UNLOAD so we don't try this entry again. * 3. release the lock while trying to unload the module. */ - changed = true; fp->flags &= ~FW_UNLOAD; /* do not try again */ /* @@ -422,9 +419,11 @@ restart: mtx_unlock(&firmware_mtx); err = linker_release_module(NULL, NULL, fp->file); mtx_lock(&firmware_mtx); - } - if (changed) { - changed = false; + + /* + * When we dropped the lock, another thread could have + * removed an element, so we must restart the scan. + */ goto restart; } mtx_unlock(&firmware_mtx); |