From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg KH Subject: Re: [PATCHSET] kthread_worker: reimplement flush_kthread_work() to allow freeing during execution Date: Thu, 27 Sep 2012 17:19:11 -0700 Message-ID: <20120928001911.GL29949@kroah.com> References: <20120719211510.GA32763@google.com> <20120917194016.GI18677@google.com> <20120917202850.GA18910@kroah.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Andy Walls , kvm-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Colin Cross , ivtv-devel-jGorlIydJmRM656bX5wj8A@public.gmane.org, Avi Kivity , spi-devel-general-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, Andrew Morton , Linus Torvalds , linux-media-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Tejun Heo Return-path: Content-Disposition: inline In-Reply-To: <20120917202850.GA18910-U8xfFu+wG4EAvxtiuMwx3w@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spi-devel-general-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org On Mon, Sep 17, 2012 at 01:28:50PM -0700, Greg KH wrote: > On Mon, Sep 17, 2012 at 12:40:16PM -0700, Tejun Heo wrote: > > On Fri, Sep 14, 2012 at 03:50:40PM -0700, Colin Cross wrote: > > > This patch set fixes a reproducible crash I'm seeing on a 3.4.10 > > > kernel. flush_kthread_worker (which is different from > > > flush_kthread_work) is initializing a kthread_work and a completion on > > > the stack, then queuing it and calling wait_for_completion. Once the > > > completion is signaled, flush_kthread_worker exits and the stack > > > region used by the kthread_work may be immediately reused by another > > > object on the stack, but kthread_worker_fn continues accessing its > > > work pointer: > > > work->func(work); <- calls complete, > > > effectively frees work > > > smp_wmb(); /* wmb worker-b0 paired with flush-b1 */ > > > work->done_seq = work->queue_seq; <- overwrites a > > > new stack object > > > smp_mb(); /* mb worker-b1 paired with flush-b0 */ > > > if (atomic_read(&work->flushing)) > > > wake_up_all(&work->done); <- or crashes here > > > > > > These patches fix the problem by not accessing work after work->func > > > is called, and should be backported to stable. They apply cleanly to > > > 3.4.10. Upstream commits are 9a2e03d8ed518a61154f18d83d6466628e519f94 > > > and 46f3d976213452350f9d10b0c2780c2681f7075b. > > > > Yeah, you're right. I wonder why this didn't come up before. Greg, > > can you please pick up these two commits? > > Ok, will do, thanks for letting me know. Now applied, thanks. greg k-h ------------------------------------------------------------------------------ Got visibility? Most devs has no idea what their production app looks like. Find out how fast your code is with AppDynamics Lite. http://ad.doubleclick.net/clk;262219671;13503038;y? http://info.appdynamics.com/FreeJavaPerformanceDownload.html