Re: [PATCH] linux-2.6.18: netback: take net_schedule_list_lock when removing entry from net_schedule_list

[Laszlo Ersek <lersek@redhat.com>]

Hi,

On 11/02/10 09:13, Jan Beulich wrote:
> From: Ian Campbell<ian.campbell@citrix.com>
>
> There is a race in net_tx_build_mops between checking if
> net_schedule_list is empty and actually dequeuing the first entry on
> the list. If another thread dequeues the only entry on the list during
> this window we crash because list_first_entry expects a non-empty
> list, like so:
>
> [trace snipped]

I can't find a net_tx_build_mops() function in 2.6.18. I believe I can 
see what the patch does (*), but for 2.6.18, I think the consequences of 
popping one from an empty list differ from the above.

Therefore, can somebody please describe how to reproduce this bug? What 
steps did lead to the NULL dereference in the original 2.6.32 environment?

(*) It takes the locking out of remove_from_net_schedule_list() and 
moves that reponsibility to the callers of 
remove_from_net_schedule_list(). This is justified by the difference 
between call sites: netif_deschedule_work() follows the old behavior, 
but poll_net_schedule_list() (and transitively, net_tx_action()) needs 
to lock the following together:
- checking for non-emptiness,
- modifying the first element,
- removing the first element from the list.

I think without the patch the race could result in memory corruption 
(even if with different consequences than above), but how can one 
trigger the race?

Thank you,
Laszlo Ersek