Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1313677

[PATCH 4.1 39/43] rhashtable: Fix walker list corruption

Show all headers | View raw

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

[ Upstream commit c6ff5268293ef98e48a99597e765ffc417e39fa5 ]

The commit ba7c95ea3870fe7b847466d39a049ab6f156aa2c ("rhashtable:
Fix sleeping inside RCU critical section in walk_stop") introduced
a new spinlock for the walker list.  However, it did not convert
all existing users of the list over to the new spin lock.  Some
continued to use the old mutext for this purpose.  This obviously
led to corruption of the list.

The fix is to use the spin lock everywhere where we touch the list.

This also allows us to do rcu_rad_lock before we take the lock in
rhashtable_walk_start.  With the old mutex this would've deadlocked
but it's safe with the new spin lock.

Fixes: ba7c95ea3870 ("rhashtable: Fix sleeping inside RCU...")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/rhashtable.c |   19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -506,10 +506,11 @@ int rhashtable_walk_init(struct rhashtab
 	if (!iter->walker)
 		return -ENOMEM;
 
-	mutex_lock(&ht->mutex);
-	iter->walker->tbl = rht_dereference(ht->tbl, ht);
+	spin_lock(&ht->lock);
+	iter->walker->tbl =
+		rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock));
 	list_add(&iter->walker->list, &iter->walker->tbl->walkers);
-	mutex_unlock(&ht->mutex);
+	spin_unlock(&ht->lock);
 
 	return 0;
 }
@@ -523,10 +524,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
  */
 void rhashtable_walk_exit(struct rhashtable_iter *iter)
 {
-	mutex_lock(&iter->ht->mutex);
+	spin_lock(&iter->ht->lock);
 	if (iter->walker->tbl)
 		list_del(&iter->walker->list);
-	mutex_unlock(&iter->ht->mutex);
+	spin_unlock(&iter->ht->lock);
 	kfree(iter->walker);
 }
 EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
@@ -550,14 +551,12 @@ int rhashtable_walk_start(struct rhashta
 {
 	struct rhashtable *ht = iter->ht;
 
-	mutex_lock(&ht->mutex);
+	rcu_read_lock();
 
+	spin_lock(&ht->lock);
 	if (iter->walker->tbl)
 		list_del(&iter->walker->list);
-
-	rcu_read_lock();
-
-	mutex_unlock(&ht->mutex);
+	spin_unlock(&ht->lock);
 
 	if (!iter->walker->tbl) {
 		iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.1 00/43] 4.1.16-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 40/43] KEYS: Fix race between key destruction and finding a keyring by name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 25/43] sh_eth: fix kernel oops in skb_put() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 39/43] rhashtable: Fix walker list corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 31/43] net_sched: make qdisc_tree_decrease_qlen() work for non mq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 37/43] af_unix: Revert lock_interruptible in stream receive code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 20/43] sctp: also copy sk_tsflags when copying the socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 11/43] usb: core : hub: Fix BOS NULL pointer kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 05/43] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 15/43] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 10/43] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 04/43] USB: serial: Another Infineon flash loader USB ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 01/43] tpm, tpm_tis: fix tpm_tis ACPI detection issue with TPM 2.0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 07/43] USB: add quirk for devices with broken LPM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 12/43] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 13/43] pppoe: fix memory corruption in padt work structure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 06/43] USB: cp210x: Remove CP2110 ID from compatibility list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 17/43] vxlan: fix incorrect RCO bit in VXLAN header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 14/43] gre6: allow to update all parameters via rtnl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 03/43] USB: cdc_acm: Ignore Infineon Flash Loader utility Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  Re: [PATCH 4.1 00/43] 4.1.16-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-21 01:00 +0100
  Re: [PATCH 4.1 00/43] 4.1.16-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-21 13:30 +0100

csiph-web