From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756446AbcCaJkd (ORCPT ); Thu, 31 Mar 2016 05:40:33 -0400 Received: from mail.efficios.com ([78.47.125.74]:56674 "EHLO mail.efficios.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756507AbcCaJk3 (ORCPT ); Thu, 31 Mar 2016 05:40:29 -0400 Date: Thu, 31 Mar 2016 09:40:21 +0000 (UTC) From: Mathieu Desnoyers To: Peter Hurley , Huang Ying Cc: Greg Kroah-Hartman , "Paul E. McKenney" , Andi Kleen , "David S. Miller" , lkml Message-ID: <1934237589.41303.1459417221186.JavaMail.zimbra@efficios.com> In-Reply-To: <513177315.41302.1459417186529.JavaMail.zimbra@efficios.com> References: <513177315.41302.1459417186529.JavaMail.zimbra@efficios.com> Subject: Re: Possible ABA in use of llist.h llist_del_first() in tty_buffer and ib_rdma MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [78.47.125.74] X-Mailer: Zimbra 8.6.0_GA_1178 (ZimbraWebClient - FF45 (Linux)/8.6.0_GA_1178) Thread-Topic: Possible ABA in use of llist.h llist_del_first() in tty_buffer and ib_rdma Thread-Index: h5a73kGKma47y15GArTFVuH/to0H0KrUjBWh Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org CCing LKML. ----- On Mar 31, 2016, at 5:39 AM, Mathieu Desnoyers mathieu.desnoyers@efficios.com wrote: > Hi, > > Code review (really: grepping the Linux kernel for > llist_del_first) leads me to notice two possible ABA issues. > The first one is in drivers/tty/tty_buffer.c, and is due to > its use of llist_del_all and llist_del_first without locking > since commit 809850b7a5 "tty: Use lockless flip buffer free list". > > Unfortunately, it appears to do so without respecting the > locking requirements associated with llist_del_first. > > Quoting llist.h: > > " * If there are multiple producers and one consumer, llist_add can be > * used in producers and llist_del_all or llist_del_first can be used > * in the consumer. > * > * This can be summarized as follow: > * > * | add | del_first | del_all > * add | - | - | - > * del_first | | L | L > * del_all | | | - > * > * Where "-" stands for no lock is needed, while "L" stands for lock > * is needed. > " > > As soon as a llist_del_first() is used, then both llist_del_first() > and llist_del_all() need to be protected by a lock, thus preventing > ABA in llist_del_first(). > > An alternative to locking would be to only use llist_del_all() and > never llist_del_first(). > > I'm also noticing a similar concurrent use of llist_del_first() and > llist_del_all() in commit 1bc144b625 "net, rds, Replace xlist in net/rds/xlist.h > with llist". > The locking surrounding their use (especially in rds_ib_reuse_mr) > don't appear clearly documented there. Perhaps there was a preexisting > issue with the xlist.h use too ? > > Thanks, > > Mathieu > > -- > Mathieu Desnoyers > EfficiOS Inc. > http://www.efficios.com -- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com