2.6.8.1 MegaRAID Driver Race

[PATCH] 2.6.8.1 to LSI Logic MegaRAID Adapter - ioctl function calls mega_internal_command, which uses wait_event, which calls schedule. This means schedule() is called while big kernel_lock is held.

Locks/Unlocks were done here because

1. There are a lot of return()s in the ioctl function to dodge.
2. mega_internal_command is also called by read and writes, which don't hold big kernel_lock

Brad Goodman <[email protected]>

@@ -38,6 +38,7 @@
 #include <linux/blkdev.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
+#include <linux/smp_lock.h>
 #include <linux/delay.h>
 #include <linux/proc_fs.h>
 #include <linux/reboot.h>

@@ -3622,7 +3623,9 @@
 			/*
 			 * Issue the command
 			 */
+			unlock_kernel();
 			mega_internal_command(adapter, LOCK_INT, &mc, pthru);
+			lock_kernel();
 
 			rval = mega_n_to_m((void __user *)arg, &mc);
 

@@ -3705,7 +3708,9 @@
 			/*
 			 * Issue the command
 			 */
+			unlock_kernel();
 			mega_internal_command(adapter, LOCK_INT, &mc, NULL);
+			lock_kernel();
 
 			rval = mega_n_to_m((void __user *)arg, &mc);
 

Calling schedule() inside lock_kernel() is legal.

It may, however, be wrong within the context of the particular caller because schedule() will drop the lock. So new races might have been introduced.

This is allowed. The bkl is dropped and regained across sleeps. Its a lock that gives "traditional unix semantics" not a normal lock.