9P: Fix race in p9_write_work()

See previous commit about p9_read_work() for details.

This fixes a similar race between p9_write_work() and p9_poll_mux()

Signed-off-by: Simon Derr <simon.derr@bull.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 7088a94b2601798a9d0e60ec4a5f91c14f799d00..b2c308fffb8a543be8d1cc284a2961478769a381 100644 (file)
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -476,10 +476,9 @@ static void p9_write_work(struct work_struct *work)
        clear_bit(Wpending, &m->wsched);
        err = p9_fd_write(m->client, m->wbuf + m->wpos, m->wsize - m->wpos);
        p9_debug(P9_DEBUG_TRANS, "mux %p sent %d bytes\n", m, err);
-       if (err == -EAGAIN) {
-               clear_bit(Wworksched, &m->wsched);
-               return;
-       }
+       if (err == -EAGAIN)
+               goto end_clear;
+
 
        if (err < 0)
                goto error;
@@ -492,19 +491,21 @@ static void p9_write_work(struct work_struct *work)
        if (m->wpos == m->wsize)
                m->wpos = m->wsize = 0;
 
+end_clear:
+       clear_bit(Wworksched, &m->wsched);
+
        if (m->wsize || !list_empty(&m->unsent_req_list)) {
                if (test_and_clear_bit(Wpending, &m->wsched))
                        n = POLLOUT;
                else
                        n = p9_fd_poll(m->client, NULL);
 
-               if (n & POLLOUT) {
+               if ((n & POLLOUT) &&
+                  !test_and_set_bit(Wworksched, &m->wsched)) {
                        p9_debug(P9_DEBUG_TRANS, "sched write work %p\n", m);
                        schedule_work(&m->wq);
-               } else
-                       clear_bit(Wworksched, &m->wsched);
-       } else
-               clear_bit(Wworksched, &m->wsched);
+               }
+       }
 
        return;