Subject: Re: [tip:locking/urgent] locking/rwsem-spinlock: Fix EINTR branch in
 __down_write_common()
To: <stable@vger.kernel.org>, <torvalds@linux-foundation.org>,
        <tglx@linutronix.de>, <a.p.zijlstra@chello.nl>, <ktkhai@virtuozzo.com>,
        <hpa@zytor.com>, <linux-kernel@vger.kernel.org>,
        <peterz@infradead.org>, <mingo@kernel.org>,
        <linux-tip-commits@vger.kernel.org>
References: <149762063282.19811.9129615532201147826.stgit@localhost.localdomain>
 <tip-a0c4acd2c220376b4e9690e75782d0c0afdaab9f@git.kernel.org>
From: Niklas Cassel <niklas.cassel@axis.com>
Message-ID: <8a41493e-8752-dd11-0c00-f441b0ac27c6@axis.com>
Date: Wed, 5 Jul 2017 16:45:07 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <tip-a0c4acd2c220376b4e9690e75782d0c0afdaab9f@git.kernel.org>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2553
Lines: 71

On 07/05/2017 04:27 PM, tip-bot for Kirill Tkhai wrote:
> Commit-ID:  a0c4acd2c220376b4e9690e75782d0c0afdaab9f
> Gitweb:     http://git.kernel.org/tip/a0c4acd2c220376b4e9690e75782d0c0afdaab9f
> Author:     Kirill Tkhai <ktkhai@virtuozzo.com>
> AuthorDate: Fri, 16 Jun 2017 16:44:34 +0300
> Committer:  Ingo Molnar <mingo@kernel.org>
> CommitDate: Wed, 5 Jul 2017 12:26:29 +0200
> 
> locking/rwsem-spinlock: Fix EINTR branch in __down_write_common()
> 
> If a writer could been woken up, the above branch
> 
> 	if (sem->count == 0)
> 		break;
> 
> would have moved us to taking the sem. So, it's
> not the time to wake a writer now, and only readers
> are allowed now. Thus, 0 must be passed to __rwsem_do_wake().
> 
> Next, __rwsem_do_wake() wakes readers unconditionally.
> But we mustn't do that if the sem is owned by writer
> in the moment. Otherwise, writer and reader own the sem
> the same time, which leads to memory corruption in
> callers.
> 
> rwsem-xadd.c does not need that, as:
> 
>   1) the similar check is made lockless there,
>   2) in __rwsem_mark_wake::try_reader_grant we test,
> 
> that sem is not owned by writer.
> 
> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
> Cc: <stable@vger.kernel.org>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Niklas Cassel <niklas.cassel@axis.com>
> Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Fixes: 17fcbd590d0c "locking/rwsem: Fix down_write_killable() for CONFIG_RWSEM_GENERIC_SPINLOCK=y"
> Link: http://lkml.kernel.org/r/149762063282.19811.9129615532201147826.stgit@localhost.localdomain
> Signed-off-by: Ingo Molnar <mingo@kernel.org>
> ---
>  kernel/locking/rwsem-spinlock.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/locking/rwsem-spinlock.c b/kernel/locking/rwsem-spinlock.c
> index c65f798..20819df 100644
> --- a/kernel/locking/rwsem-spinlock.c
> +++ b/kernel/locking/rwsem-spinlock.c
> @@ -231,8 +231,8 @@ int __sched __down_write_common(struct rw_semaphore *sem, int state)
>  
>  out_nolock:
>  	list_del(&waiter.list);
> -	if (!list_empty(&sem->wait_list))
> -		__rwsem_do_wake(sem, 1);
> +	if (!list_empty(&sem->wait_list) && sem->count >= 0)
> +		__rwsem_do_wake(sem, 0);
>  	raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
>  
>  	return -EINTR;
> 

For the record, there is actually a v2 of this:

http://marc.info/?l=linux-kernel&m=149866422128912


Regards,
Niklas