[patch] LIST_POISON with rcu

[patch] LIST_POISON with rcu

[Maneesh Soni]

Hi,

LIST_POISON will not work with RCU based lists as we depend on the
fact the deleted list element can still point to the existing list. 
Though any new user will not be able to reach the deleted element.
This is one of the reasons why we don't do list_del_init_rcu(). 
The folloing patch fixes this.

Trond, I am not sure if you are seeing the d_move() oops because
of this. It will be nice if you can post the oops message also.

Regards,
Maneesh

diff -urN linux-2.5.70-mm8/include/linux/list.h linux-2.5.70-mm8-LIST_POISON/include/linux/list.h
--- linux-2.5.70-mm8/include/linux/list.h	Thu Jun 12 15:26:06 2003
+++ linux-2.5.70-mm8-LIST_POISON/include/linux/list.h	Thu Jun 12 15:24:51 2003
@@ -162,8 +162,6 @@
 static inline void list_del_rcu(struct list_head *entry)
 {
 	__list_del(entry->prev, entry->next);
-	entry->next = LIST_POISON1;
-	entry->prev = LIST_POISON2;
 }
 
 /**
@@ -434,7 +432,10 @@
 	n->pprev = LIST_POISON2;
 }
 
-#define hlist_del_rcu hlist_del  /* list_del_rcu is identical too? */
+static __inline__ void hlist_del_rcu(struct hlist_node *n)
+{
+	__hlist_del(n);
+}
 
 static __inline__ void hlist_del_init(struct hlist_node *n) 
 {



-- 
Maneesh Soni
IBM Linux Technology Center, 
IBM India Software Lab, Bangalore.
Phone: +91-80-5044999 email: maneesh@in.ibm.com
http://lse.sourceforge.net/

[patch] LIST_POISON with rcu

[Trond Myklebust]

>>>>> " " == Maneesh Soni <maneesh@in.ibm.com> writes:

     > LIST_POISON will not work with RCU based lists as we depend on
     > the fact the deleted list element can still point to the
     > existing list.

Then you have a clear problem: you'll need some way of marking the
node as hashed or unhashed, other than testing those pointers.

     > Trond, I am not sure if you are seeing the d_move() oops
     > because of this. It will be nice if you can post the oops
     > message also.

The d_move Oops is not a direct consequence of the hlist_del_rcu
poisoning since d_drop now uses hlist_del_rcu_init. The effect is
the same though, as you can see below.

printing eip:
c019221c
*pde = 00000000
Oops: 0002 [#1]
CPU:    0
EIP:    0060:[<c019221c>]    Not tainted
EFLAGS: 00010246
EIP is at d_move+0x1e8/0x8b2
eax: 00000000   ebx: de8935c0   ecx: de893648 edx: 00000000
esi: de54129c   edi: d6414a80   ebp: d4b01e24  esp: d4b01de8
ds: 007b   es: 007b   ss: 0068
Process mv (pid: 1496, threadinfo=d4b00000 task=dacd1e80)
Stack: 14380000 3ee795f2 d9780000 3ee795f2 d9780000 d4b01e10 c01531b3 d6414b3c
       00000000 ffffffff d4b01e24 0005aad1 d4b01e40 de54129c d6414a80 d4b01e94
       e1a7f254 de8935c0 de54129c d6414a80 d4b01e78 00000002 73666e2e 32313030
Call Trace:
 [<c01531b3>] invalidate_inode_pages+0x21/0x26
 [<e1a7f254>] nfs_sillyrename+0x198/0x214 [nfs]
 [<e1a80585>] nfs_rename+0x41d/0x59c [nfs]
 [<c0185c86>] vfs_rename_other+0xd6/0xda
 [<c0185dcc>] vfs_rename+0x142/0x3a8
 [<c01861db>] sys_rename+0x1a9/0x1d6
 [<c017d0d7>] sys_lstat64+0x35/0x38
 [<c010bdd7>] syscall_call+0x7/0xb

Code: 89 02 74 03 89 50 04 c7 83 88 00 00 00 00 01 10 00 c7 41 04

Cheers,
  Trond