From: "wang, biao" <[email protected]>
Date: Fri, 3 May 2013 14:18:34 +0800
Subject: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
waitting process
There is a race between klist_remove and klist_release. klist_remove
uses a local var waiter saved on stack. When klist_release calls
wake_up_process(waiter->process) to wake up the waiter, waiter might run
immediately and reuse the stack. Then, klist_release calls
list_del(&waiter->list) to change previous
wait data and cause prior waiter thread corrupt.
The patch fixes it against kernel 3.9.
Signed-off-by: wang, biao <[email protected]>
---
lib/klist.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/lib/klist.c b/lib/klist.c
index 0874e41..358a368 100644
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
if (waiter->node != n)
continue;
+ list_del(&waiter->list);
waiter->woken = 1;
mb();
wake_up_process(waiter->process);
- list_del(&waiter->list);
}
spin_unlock(&klist_remove_lock);
knode_set_klist(n, NULL);
--
1.7.6
On Fri, May 03, 2013 at 03:06:36PM +0800, wangbiao wrote:
> From: "wang, biao" <[email protected]>
> Date: Fri, 3 May 2013 14:18:34 +0800
> Subject: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
> waitting process
>
> There is a race between klist_remove and klist_release. klist_remove
> uses a local var waiter saved on stack. When klist_release calls
> wake_up_process(waiter->process) to wake up the waiter, waiter might run
> immediately and reuse the stack. Then, klist_release calls
> list_del(&waiter->list) to change previous
> wait data and cause prior waiter thread corrupt.
>
> The patch fixes it against kernel 3.9.
I've never seen that code before in my life; but after a quick look you appear
to be completely right.
> Signed-off-by: wang, biao <[email protected]>
Acked-by: Peter Zijlstra <[email protected]>
> ---
> lib/klist.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/lib/klist.c b/lib/klist.c
> index 0874e41..358a368 100644
> --- a/lib/klist.c
> +++ b/lib/klist.c
> @@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
> if (waiter->node != n)
> continue;
>
> + list_del(&waiter->list);
> waiter->woken = 1;
> mb();
> wake_up_process(waiter->process);
> - list_del(&waiter->list);
> }
> spin_unlock(&klist_remove_lock);
> knode_set_klist(n, NULL);
> --
> 1.7.6
>
>
>
Andrew,
Would you like to merge the patch to your MM tree?
Yanmin
>-----Original Message-----
>From: Peter Zijlstra [mailto:[email protected]]
>Sent: Friday, May 03, 2013 6:42 PM
>To: Wang, Biao
>Cc: [email protected]; [email protected];
>[email protected]; Zhang, Yanmin; [email protected]
>Subject: Re: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
>waitting process
>
>On Fri, May 03, 2013 at 03:06:36PM +0800, wangbiao wrote:
>> From: "wang, biao" <[email protected]>
>> Date: Fri, 3 May 2013 14:18:34 +0800
>> Subject: [PATCH] klist: del waiter from klist_remove_waiters before
>> wakeup waitting process
>>
>> There is a race between klist_remove and klist_release. klist_remove
>> uses a local var waiter saved on stack. When klist_release calls
>> wake_up_process(waiter->process) to wake up the waiter, waiter might
>> run immediately and reuse the stack. Then, klist_release calls
>> list_del(&waiter->list) to change previous wait data and cause prior
>> waiter thread corrupt.
>>
>> The patch fixes it against kernel 3.9.
>
>
>I've never seen that code before in my life; but after a quick look you appear to
>be completely right.
>
>> Signed-off-by: wang, biao <[email protected]>
>
>Acked-by: Peter Zijlstra <[email protected]>
>
>> ---
>> lib/klist.c | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/lib/klist.c b/lib/klist.c index 0874e41..358a368 100644
>> --- a/lib/klist.c
>> +++ b/lib/klist.c
>> @@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
>> if (waiter->node != n)
>> continue;
>>
>> + list_del(&waiter->list);
>> waiter->woken = 1;
>> mb();
>> wake_up_process(waiter->process);
>> - list_del(&waiter->list);
>> }
>> spin_unlock(&klist_remove_lock);
>> knode_set_klist(n, NULL);
>> --
>> 1.7.6
>>
>>
>>