Fix: call_rcu list corruption on teardown

[userspace-rcu.git] / urcu-call-rcu-impl.h

diff --git a/urcu-call-rcu-impl.h b/urcu-call-rcu-impl.h
index 182e9b15bd96552ed5e4fb8125bee02da04a8715..e38123b3fca45ecf1e068b798a7226200abbb876 100644 (file)
--- a/urcu-call-rcu-impl.h
+++ b/urcu-call-rcu-impl.h
@@ -204,7 +204,7 @@ static void call_rcu_wake_up(struct call_rcu_data *crdp)
 {
        /* Write to call_rcu list before reading/writing futex */
        cmm_smp_mb();
-       if (unlikely(uatomic_read(&crdp->futex) == -1)) {
+       if (caa_unlikely(uatomic_read(&crdp->futex) == -1)) {
                uatomic_set(&crdp->futex, 0);
                futex_async(&crdp->futex, FUTEX_WAKE, 1,
                      NULL, NULL, 0);
@@ -645,8 +645,9 @@ void call_rcu_data_free(struct call_rcu_data *crdp)
                /* Create default call rcu data if need be */
                (void) get_default_call_rcu_data();
                cbs_endprev = (struct cds_wfq_node **)
-                       uatomic_xchg(&default_call_rcu_data, cbs_tail);
-               *cbs_endprev = cbs;
+                       uatomic_xchg(&default_call_rcu_data->cbs.tail,
+                                       cbs_tail);
+               _CMM_STORE_SHARED(*cbs_endprev, cbs);
                uatomic_add(&default_call_rcu_data->qlen,
                            uatomic_read(&crdp->qlen));
                wake_call_rcu_thread(default_call_rcu_data);