Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755498AbbHYNSW (ORCPT ); Tue, 25 Aug 2015 09:18:22 -0400 Received: from mail-wi0-f176.google.com ([209.85.212.176]:35096 "EHLO mail-wi0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751726AbbHYNSU (ORCPT ); Tue, 25 Aug 2015 09:18:20 -0400 Subject: Re: [PATCH 3.12 49/82] xen/gntdevt: Fix race condition in gntdev_release() To: =?UTF-8?Q?Marek_Marczykowski-G=c3=b3recki?= , Luis Henriques References: <20150825113559.GD14096@ares> <20150825115211.GB1345@mail-itl> Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, David Vrabel , Greg Kroah-Hartman From: Jiri Slaby Message-ID: <55DC6B19.10001@suse.cz> Date: Tue, 25 Aug 2015 15:18:17 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <20150825115211.GB1345@mail-itl> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3703 Lines: 94 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 08/25/2015, 01:52 PM, Marek Marczykowski-Górecki wrote: >>> --- a/drivers/xen/gntdev.c +++ b/drivers/xen/gntdev.c @@ >>> -529,12 +529,14 @@ static int gntdev_release(struct inode >>> *inode, struct file *flip) >>> >>> pr_debug("priv %p\n", priv); >>> >>> + mutex_lock(&priv->lock); >> >> Since 3.12 doesn't seem to include 1401c00e59ea ("xen/gntdev: >> convert priv->lock to a mutex"), this shouldn't be applied as >> priv->lock is actually a spinlock. So, you'll need to pick >> 1401c00e59ea or backport this patch using the appropriate locking >> directives. Not sure what's the best solution. Maybe Marek or >> David can help...? > > I've used spinlock approach for some time (on 3.18.x) and it works > ok. This applies also to 3.10 and 3.14 of course. > > Patch here: > https://raw.githubusercontent.com/QubesOS/qubes-linux-kernel/stable-3. 18/patches.xen/0001-xen-grant-fix-race-condition-in-gntdev_release.patch > > and here: > > From b876e14888bdafa112c3265e6420543fa74aa709 Mon Sep 17 00:00:00 > 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= > Date: Fri, 26 Jun 2015 02:16:49 > +0200 Subject: [PATCH] xen/grant: fix race condition in > gntdev_release MIME-Version: 1.0 Content-Type: text/plain; > charset=UTF-8 Content-Transfer-Encoding: 8bit Organization: > Invisible Things Lab Cc: Marek Marczykowski-Górecki > > > While gntdev_release is called, MMU notifier is still registered > and will traverse priv->maps list even if no pages are mapped > (which is the case - gntdev_release is called after all). But > gntdev_release will clear that list, so make sure that only one of > those things happens at the same time. > > Signed-off-by: Marek Marczykowski-Górecki > --- drivers/xen/gntdev.c | 2 ++ 1 > file changed, 2 insertions(+) > > diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c index > 8927485..4bd23bb 100644 --- a/drivers/xen/gntdev.c +++ > b/drivers/xen/gntdev.c @@ -568,12 +568,14 @@ static int > gntdev_release(struct inode *inode, struct file *flip) > > pr_debug("priv %p\n", priv); > > + spin_lock(&priv->lock); while (!list_empty(&priv->maps)) { map = > list_entry(priv->maps.next, struct grant_map, next); > list_del(&map->next); gntdev_put_map(NULL /* already removed */, > map); } WARN_ON(!list_empty(&priv->freeable_maps)); + > spin_unlock(&priv->lock); Hmm, but e.g. gntdev_put_map -> gntdev_free_map -> free_xenballooned_pages -> mutex_lock means sleep inside atomic, right? thanks, - -- js suse labs -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV3GsVAAoJEL0lsQQGtHBJyfUP/Ro99Km/OWSpK3SRKzsVDo9z OwYzvnHdHNR8uqcS/VnzWfZokine+qWFVNdqfWx3GPRL03wt1JUdjdZTA+cIi2Xn P6PcxUXTz3aCz7vPV79nW0yLpaG+aUoCeNGFvVTfJQnz/4gNQ0DaVkD2wmy6GptX ce1mW4AofkQl5lFaWOb5xehy/qGzaj9egtZKfVrGcrAj8oRSHCOCdgW6qMbztBkI YRlZY2pBgGmkx3o6PktqouKx4zi9akEK1j9/axDzhjQxc2Put36P4XuqQIfgVqQr H2EZZD5JF8HhgIWlOvwo7Ll0TEmpaQ8ouxBUhHtNTFjYtR+r8hTwl6PfZLH9qWzT IkOF7gDMHkbm73dLG3r+pSOyLsX9f0koYFFLHyRNKPEuYjRYV65hzRgSj1feXuni l5VG2vO6YFJcmjPh8q0pKciIWvNw+4n10XEwub1Qk/PVjGZDAaTKIWw2H4q/ZAqk 9+0zQzlzGC78pGQsdLmnjFchZ7ye9/F8zuDPhNEv4MgjoI2gq1zfGgWb+bZeq4JX 3/TLh33U/a9Zlbb1HCjs/bN3l+WlYCwOqVgSwUyZwem8gZrPlJ37aukCbolHecUj xk07IaY1Wv4OHYzxdXeSd9XeUospM19WSYoVaTVBi7RBrKTHdBYHGeQxocYBgviG Ckj9O9Pe+NfT4qC0Rj6I =6tTn -----END PGP SIGNATURE----- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/