MIME-Version: 1.0
In-Reply-To: <1362183400.3420.24.camel@buesod1.americas.hpqcorp.net>
References: <1362183400.3420.24.camel@buesod1.americas.hpqcorp.net>
Date: Sat, 2 Mar 2013 13:24:13 -0800
Message-ID: <CA+55aFzxJo3y7r_5BvUVwZX4LyC6dba8qPTbp+iDf_nRgYg4cw@mail.gmail.com>
Subject: Re: [RFC PATCH 1/2] ipc: introduce obtaining a lockless ipc object
From: Linus Torvalds <torvalds@linux-foundation.org>
To: Davidlohr Bueso <davidlohr.bueso@hp.com>,
        Emmanuel Benisty <benisty.e@gmail.com>
Cc: Rik van Riel <riel@redhat.com>, "Vinod, Chegu" <chegu_vinod@hp.com>,
        "Low, Jason" <jason.low2@hp.com>, linux-tip-commits@vger.kernel.org,
        Peter Zijlstra <a.p.zijlstra@chello.nl>,
        "H. Peter Anvin" <hpa@zytor.com>,
        Andrew Morton <akpm@linux-foundation.org>, aquini@redhat.com,
        Michel Lespinasse <walken@google.com>, Ingo Molnar <mingo@kernel.org>,
        Larry Woodman <lwoodman@redhat.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        Thomas Gleixner <tglx@linutronix.de>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1397
Lines: 42

On Fri, Mar 1, 2013 at 4:16 PM, Davidlohr Bueso <davidlohr.bueso@hp.com> wrote:
> @@ -784,7 +806,7 @@ struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
>         int err;
>
>         down_write(&ids->rw_mutex);
> -       ipcp = ipc_lock_check(ids, id);
> +       ipcp = ipc_obtain_object_check(ids, id);
>         if (IS_ERR(ipcp)) {
>                 err = PTR_ERR(ipcp);
>                 goto out_up;
> @@ -801,7 +823,7 @@ struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
>                 return ipcp;
>
>         err = -EPERM;
> -       ipc_unlock(ipcp);
> +       rcu_read_unlock();
>  out_up:
>         up_write(&ids->rw_mutex);
>         return ERR_PTR(err);

Uhhuh. This is very buggy, and I think it's the reason for the later
bugs that Emmanuel reported.

In particular, the *non-error* case is buggy, where it in the middle
of the function does

    return ipcp;

for a successful lookup.

It used to return a locked ipcp, now it no longer does. And you didn't
change any of the callers, which still do the "ipc_unlock()" at the
end.  So all the locking gets completely confused.

Oops.

                 Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/