From mboxrd@z Thu Jan 1 00:00:00 1970 From: Laszlo Ersek Subject: Re: [PATCH] linux-2.6.18: netback: take net_schedule_list_lock when removing entry from net_schedule_list Date: Thu, 04 Nov 2010 12:09:14 +0100 Message-ID: <4CD2945A.4040301@redhat.com> References: <4CCFD63D0200007800020366@vpn.id2.novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4CCFD63D0200007800020366@vpn.id2.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Jan Beulich Cc: tomasz.wroblewski@citrix.com, "xen-devel@lists.xensource.com" , Ian Campbell List-Id: xen-devel@lists.xenproject.org Hi, On 11/02/10 09:13, Jan Beulich wrote: > From: Ian Campbell > > There is a race in net_tx_build_mops between checking if > net_schedule_list is empty and actually dequeuing the first entry on > the list. If another thread dequeues the only entry on the list during > this window we crash because list_first_entry expects a non-empty > list, like so: > > [trace snipped] I can't find a net_tx_build_mops() function in 2.6.18. I believe I can see what the patch does (*), but for 2.6.18, I think the consequences of popping one from an empty list differ from the above. Therefore, can somebody please describe how to reproduce this bug? What steps did lead to the NULL dereference in the original 2.6.32 environment? (*) It takes the locking out of remove_from_net_schedule_list() and moves that reponsibility to the callers of remove_from_net_schedule_list(). This is justified by the difference between call sites: netif_deschedule_work() follows the old behavior, but poll_net_schedule_list() (and transitively, net_tx_action()) needs to lock the following together: - checking for non-emptiness, - modifying the first element, - removing the first element from the list. I think without the patch the race could result in memory corruption (even if with different consequences than above), but how can one trigger the race? Thank you, Laszlo Ersek