* [PATCH] klist: del waiter from klist_remove_waiters before wakeup waitting process
@ 2013-05-03 7:06 wangbiao
2013-05-03 10:42 ` Peter Zijlstra
0 siblings, 1 reply; 4+ messages in thread
From: wangbiao @ 2013-05-03 7:06 UTC (permalink / raw)
To: akpm, linux-kernel, mingo, peterz; +Cc: biao.wang, yanmin.zhang
From: "wang, biao" <biao.wang@intel.com>
Date: Fri, 3 May 2013 14:18:34 +0800
Subject: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
waitting process
There is a race between klist_remove and klist_release. klist_remove
uses a local var waiter saved on stack. When klist_release calls
wake_up_process(waiter->process) to wake up the waiter, waiter might run
immediately and reuse the stack. Then, klist_release calls
list_del(&waiter->list) to change previous
wait data and cause prior waiter thread corrupt.
The patch fixes it against kernel 3.9.
Signed-off-by: wang, biao <biao.wang@intel.com>
---
lib/klist.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/lib/klist.c b/lib/klist.c
index 0874e41..358a368 100644
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
if (waiter->node != n)
continue;
+ list_del(&waiter->list);
waiter->woken = 1;
mb();
wake_up_process(waiter->process);
- list_del(&waiter->list);
}
spin_unlock(&klist_remove_lock);
knode_set_klist(n, NULL);
--
1.7.6
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] klist: del waiter from klist_remove_waiters before wakeup waitting process
2013-05-03 7:06 [PATCH] klist: del waiter from klist_remove_waiters before wakeup waitting process wangbiao
@ 2013-05-03 10:42 ` Peter Zijlstra
2013-05-07 8:49 ` Zhang, Yanmin
0 siblings, 1 reply; 4+ messages in thread
From: Peter Zijlstra @ 2013-05-03 10:42 UTC (permalink / raw)
To: wangbiao; +Cc: akpm, linux-kernel, mingo, yanmin.zhang, mochel
On Fri, May 03, 2013 at 03:06:36PM +0800, wangbiao wrote:
> From: "wang, biao" <biao.wang@intel.com>
> Date: Fri, 3 May 2013 14:18:34 +0800
> Subject: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
> waitting process
>
> There is a race between klist_remove and klist_release. klist_remove
> uses a local var waiter saved on stack. When klist_release calls
> wake_up_process(waiter->process) to wake up the waiter, waiter might run
> immediately and reuse the stack. Then, klist_release calls
> list_del(&waiter->list) to change previous
> wait data and cause prior waiter thread corrupt.
>
> The patch fixes it against kernel 3.9.
I've never seen that code before in my life; but after a quick look you appear
to be completely right.
> Signed-off-by: wang, biao <biao.wang@intel.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
> ---
> lib/klist.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/lib/klist.c b/lib/klist.c
> index 0874e41..358a368 100644
> --- a/lib/klist.c
> +++ b/lib/klist.c
> @@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
> if (waiter->node != n)
> continue;
>
> + list_del(&waiter->list);
> waiter->woken = 1;
> mb();
> wake_up_process(waiter->process);
> - list_del(&waiter->list);
> }
> spin_unlock(&klist_remove_lock);
> knode_set_klist(n, NULL);
> --
> 1.7.6
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: [PATCH] klist: del waiter from klist_remove_waiters before wakeup waitting process
2013-05-03 10:42 ` Peter Zijlstra
@ 2013-05-07 8:49 ` Zhang, Yanmin
0 siblings, 0 replies; 4+ messages in thread
From: Zhang, Yanmin @ 2013-05-07 8:49 UTC (permalink / raw)
To: Peter Zijlstra, Wang, Biao
Cc: akpm@linux-foundation.org, linux-kernel@vger.kernel.org,
mingo@redhat.com, mochel@digitalimplant.org
Andrew,
Would you like to merge the patch to your MM tree?
Yanmin
>-----Original Message-----
>From: Peter Zijlstra [mailto:peterz@infradead.org]
>Sent: Friday, May 03, 2013 6:42 PM
>To: Wang, Biao
>Cc: akpm@linux-foundation.org; linux-kernel@vger.kernel.org;
>mingo@redhat.com; Zhang, Yanmin; mochel@digitalimplant.org
>Subject: Re: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
>waitting process
>
>On Fri, May 03, 2013 at 03:06:36PM +0800, wangbiao wrote:
>> From: "wang, biao" <biao.wang@intel.com>
>> Date: Fri, 3 May 2013 14:18:34 +0800
>> Subject: [PATCH] klist: del waiter from klist_remove_waiters before
>> wakeup waitting process
>>
>> There is a race between klist_remove and klist_release. klist_remove
>> uses a local var waiter saved on stack. When klist_release calls
>> wake_up_process(waiter->process) to wake up the waiter, waiter might
>> run immediately and reuse the stack. Then, klist_release calls
>> list_del(&waiter->list) to change previous wait data and cause prior
>> waiter thread corrupt.
>>
>> The patch fixes it against kernel 3.9.
>
>
>I've never seen that code before in my life; but after a quick look you appear to
>be completely right.
>
>> Signed-off-by: wang, biao <biao.wang@intel.com>
>
>Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
>
>> ---
>> lib/klist.c | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/lib/klist.c b/lib/klist.c index 0874e41..358a368 100644
>> --- a/lib/klist.c
>> +++ b/lib/klist.c
>> @@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
>> if (waiter->node != n)
>> continue;
>>
>> + list_del(&waiter->list);
>> waiter->woken = 1;
>> mb();
>> wake_up_process(waiter->process);
>> - list_del(&waiter->list);
>> }
>> spin_unlock(&klist_remove_lock);
>> knode_set_klist(n, NULL);
>> --
>> 1.7.6
>>
>>
>>
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] klist: del waiter from klist_remove_waiters before wakeup waitting process
@ 2013-05-16 1:50 wangbiao
0 siblings, 0 replies; 4+ messages in thread
From: wangbiao @ 2013-05-16 1:50 UTC (permalink / raw)
To: gregkh, linux-kernel; +Cc: peterz, akpm, mingo, yanmin.zhang, biao.wang
From: "wang, biao" <biao.wang@intel.com>
Date: Fri, 3 May 2013 14:18:34 +0800
Subject: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
waitting process
There is a race between klist_remove and klist_release. klist_remove
uses a local var waiter saved on stack. When klist_release calls
wake_up_process(waiter->process) to wake up the waiter, waiter might run
immediately and reuse the stack. Then, klist_release calls
list_del(&waiter->list) to change previous
wait data and cause prior waiter thread corrupt.
The patch fixes it against kernel 3.9.
Signed-off-by: wang, biao <biao.wang@intel.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
---
lib/klist.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/lib/klist.c b/lib/klist.c
index 0874e41..358a368 100644
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
if (waiter->node != n)
continue;
+ list_del(&waiter->list);
waiter->woken = 1;
mb();
wake_up_process(waiter->process);
- list_del(&waiter->list);
}
spin_unlock(&klist_remove_lock);
knode_set_klist(n, NULL);
--
1.7.6
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-05-16 1:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-05-03 7:06 [PATCH] klist: del waiter from klist_remove_waiters before wakeup waitting process wangbiao
2013-05-03 10:42 ` Peter Zijlstra
2013-05-07 8:49 ` Zhang, Yanmin
-- strict thread matches above, loose matches on Subject: below --
2013-05-16 1:50 wangbiao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox