From: "Paul E. McKenney" <paulmck@kernel.org>
To: rcu@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, kernel-team@fb.com,
rostedt@goodmis.org, "Paul E. McKenney" <paulmck@kernel.org>
Subject: [PATCH rcu 01/19] srcu: Tighten cleanup_srcu_struct() GP checks
Date: Fri, 4 Feb 2022 15:38:44 -0800 [thread overview]
Message-ID: <20220204233902.1902-1-paulmck@kernel.org> (raw)
In-Reply-To: <20220204233858.GA1469@paulmck-ThinkPad-P17-Gen-1>
Currently, cleanup_srcu_struct() checks for a grace period in progress,
but it does not check for a grace period that has not yet started but
which might start at any time. Such a situation could result in a
use-after-free bug, so this commit adds a check for a grace period that
is needed but not yet started to cleanup_srcu_struct().
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
---
kernel/rcu/srcutree.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 6833d88871816..d30e4db04506a 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -382,9 +382,11 @@ void cleanup_srcu_struct(struct srcu_struct *ssp)
return; /* Forgot srcu_barrier(), so just leak it! */
}
if (WARN_ON(rcu_seq_state(READ_ONCE(ssp->srcu_gp_seq)) != SRCU_STATE_IDLE) ||
+ WARN_ON(rcu_seq_current(&ssp->srcu_gp_seq) != ssp->srcu_gp_seq_needed) ||
WARN_ON(srcu_readers_active(ssp))) {
- pr_info("%s: Active srcu_struct %p state: %d\n",
- __func__, ssp, rcu_seq_state(READ_ONCE(ssp->srcu_gp_seq)));
+ pr_info("%s: Active srcu_struct %p read state: %d gp state: %lu/%lu\n",
+ __func__, ssp, rcu_seq_state(READ_ONCE(ssp->srcu_gp_seq)),
+ rcu_seq_current(&ssp->srcu_gp_seq), ssp->srcu_gp_seq_needed);
return; /* Caller forgot to stop doing call_srcu()? */
}
free_percpu(ssp->sda);
--
2.31.1.189.g2e36527f23
next prev parent reply other threads:[~2022-02-04 23:39 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-04 23:38 [PATCH rcu 0/19] SRCU updates for v5.18 Paul E. McKenney
2022-02-04 23:38 ` Paul E. McKenney [this message]
2022-02-04 23:38 ` [PATCH rcu 02/19] srcu: Fix s/is/if/ typo in srcu_node comment Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 03/19] srcu: Make srcu_funnel_gp_start() cache ->mynode in snp_leaf Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 04/19] srcu: Dynamically allocate srcu_node array Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 05/19] srcu: Make Tree SRCU able to operate without snp_node array Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 06/19] srcu: Add size-state transitioning code Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 07/19] srcu: Make rcutorture dump the SRCU size state Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 08/19] srcu: Add boot-time control over srcu_node array allocation Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 09/19] srcu: Use export for srcu_struct defined by DEFINE_STATIC_SRCU() Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 10/19] srcu: Compute snp_seq earlier in srcu_funnel_gp_start() Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 11/19] srcu: Use invalid initial value for srcu_node GP sequence numbers Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 12/19] srcu: Avoid NULL dereference in srcu_torture_stats_print() Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 13/19] srcu: Prevent cleanup_srcu_struct() from freeing non-dynamic ->sda Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 14/19] srcu: Explain srcu_funnel_gp_start() call to list_add() is safe Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 15/19] srcu: Create concurrency-safe helper for initiating size transition Paul E. McKenney
2022-02-04 23:38 ` [PATCH rcu 16/19] srcu: Add contention-triggered addition of srcu_node tree Paul E. McKenney
2022-02-04 23:39 ` [PATCH rcu 17/19] srcu: Make srcu_size_state_name static Paul E. McKenney
2022-02-04 23:39 ` [PATCH rcu 18/19] srcu: Automatically determine size-transition strategy at boot Paul E. McKenney
2022-02-04 23:39 ` [PATCH rcu 19/19] srcu: Add contention check to call_srcu() srcu_data ->lock acquisition Paul E. McKenney
[not found] ` <20220205030303.2408-1-hdanton@sina.com>
2022-02-05 5:20 ` Paul E. McKenney
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220204233902.1902-1-paulmck@kernel.org \
--to=paulmck@kernel.org \
--cc=kernel-team@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rcu@vger.kernel.org \
--cc=rostedt@goodmis.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox