Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755734AbbHYLgG (ORCPT ); Tue, 25 Aug 2015 07:36:06 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:45927 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755709AbbHYLgD (ORCPT ); Tue, 25 Aug 2015 07:36:03 -0400 Date: Tue, 25 Aug 2015 12:35:59 +0100 From: Luis Henriques To: Jiri Slaby Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, Marek =?iso-8859-1?Q?Marczykowski-G=F3recki?= , David Vrabel , Greg Kroah-Hartman Subject: Re: [PATCH 3.12 49/82] xen/gntdevt: Fix race condition in gntdev_release() Message-ID: <20150825113559.GD14096@ares> References: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2418 Lines: 66 [ Adding Greg has he seems to have this patch queued for 3.10 and 3.14 ] On Mon, Aug 24, 2015 at 11:09:09AM +0200, Jiri Slaby wrote: > From: Marek Marczykowski-G?recki > > 3.12-stable review patch. If anyone has any objections, please let me know. > > =============== > > commit 30b03d05e07467b8c6ec683ea96b5bffcbcd3931 upstream. > > While gntdev_release() is called the MMU notifier is still registered > and can traverse priv->maps list even if no pages are mapped (which is > the case -- gntdev_release() is called after all). But > gntdev_release() will clear that list, so make sure that only one of > those things happens at the same time. > > Signed-off-by: Marek Marczykowski-G?recki > Signed-off-by: David Vrabel > Signed-off-by: Jiri Slaby > --- > drivers/xen/gntdev.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c > index e41c79c986ea..f2ca8d0af55f 100644 > --- a/drivers/xen/gntdev.c > +++ b/drivers/xen/gntdev.c > @@ -529,12 +529,14 @@ static int gntdev_release(struct inode *inode, struct file *flip) > > pr_debug("priv %p\n", priv); > > + mutex_lock(&priv->lock); Since 3.12 doesn't seem to include 1401c00e59ea ("xen/gntdev: convert priv->lock to a mutex"), this shouldn't be applied as priv->lock is actually a spinlock. So, you'll need to pick 1401c00e59ea or backport this patch using the appropriate locking directives. Not sure what's the best solution. Maybe Marek or David can help...? Cheers, -- Lu?s > while (!list_empty(&priv->maps)) { > map = list_entry(priv->maps.next, struct grant_map, next); > list_del(&map->next); > gntdev_put_map(NULL /* already removed */, map); > } > WARN_ON(!list_empty(&priv->freeable_maps)); > + mutex_unlock(&priv->lock); > > if (use_ptemod) > mmu_notifier_unregister(&priv->mn, priv->mm); > -- > 2.5.0 > > -- > To unsubscribe from this list: send the line "unsubscribe stable" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/