Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1249750
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.14 22/79] sched/core: Fix TASK_DEAD race in finish_task_switch() |
| Date | 2015-10-18 05:30 +0200 |
| Message-ID | <qkMPw-19j-11@gated-at.bofh.it> (permalink) |
| References | <qkMw9-KI-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 95913d97914f44db2b81271c2e2ebd4d2ac2df83 upstream.
So the problem this patch is trying to address is as follows:
CPU0 CPU1
context_switch(A, B)
ttwu(A)
LOCK A->pi_lock
A->on_cpu == 0
finish_task_switch(A)
prev_state = A->state <-.
WMB |
A->on_cpu = 0; |
UNLOCK rq0->lock |
| context_switch(C, A)
`-- A->state = TASK_DEAD
prev_state == TASK_DEAD
put_task_struct(A)
context_switch(A, C)
finish_task_switch(A)
A->state == TASK_DEAD
put_task_struct(A)
The argument being that the WMB will allow the load of A->state on CPU0
to cross over and observe CPU1's store of A->state, which will then
result in a double-drop and use-after-free.
Now the comment states (and this was true once upon a long time ago)
that we need to observe A->state while holding rq->lock because that
will order us against the wakeup; however the wakeup will not in fact
acquire (that) rq->lock; it takes A->pi_lock these days.
We can obviously fix this by upgrading the WMB to an MB, but that is
expensive, so we'd rather avoid that.
The alternative this patch takes is: smp_store_release(&A->on_cpu, 0),
which avoids the MB on some archs, but not important ones like ARM.
Reported-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Cc: manfred@colorfullife.com
Cc: will.deacon@arm.com
Fixes: e4a52bcb9a18 ("sched: Remove rq->lock from the first half of ttwu()")
Link: http://lkml.kernel.org/r/20150929124509.GG3816@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 10 +++++-----
kernel/sched/sched.h | 5 +++--
2 files changed, 8 insertions(+), 7 deletions(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2136,11 +2136,11 @@ static void finish_task_switch(struct rq
* If a task dies, then it sets TASK_DEAD in tsk->state and calls
* schedule one last time. The schedule call will never return, and
* the scheduled task must drop that reference.
- * The test for TASK_DEAD must occur while the runqueue locks are
- * still held, otherwise prev could be scheduled on another cpu, die
- * there before we look at prev->state, and then the reference would
- * be dropped twice.
- * Manfred Spraul <manfred@colorfullife.com>
+ *
+ * We must observe prev->state before clearing prev->on_cpu (in
+ * finish_lock_switch), otherwise a concurrent wakeup can get prev
+ * running on another CPU and we could rave with its RUNNING -> DEAD
+ * transition, resulting in a double drop.
*/
prev_state = prev->state;
vtime_task_switch(prev);
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -994,9 +994,10 @@ static inline void finish_lock_switch(st
* After ->on_cpu is cleared, the task can be moved to a different CPU.
* We must ensure this doesn't happen until the switch is completely
* finished.
+ *
+ * Pairs with the control dependency and rmb in try_to_wake_up().
*/
- smp_wmb();
- prev->on_cpu = 0;
+ smp_store_release(&prev->on_cpu, 0);
#endif
#ifdef CONFIG_DEBUG_SPINLOCK
/* this is a valid case when another task releases the spinlock */
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 50/79] ipvs: do not use random local source address for tunnels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 69/79] vfs: Test for and handle paths that are unreachable from their mnt_root Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 38/79] netfilter: nf_conntrack: Support expectations in different zones Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 45/79] USB: whiteheat: fix potential null-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 44/79] drm: Reject DRI1 hw lock ioctl functions for kms drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 07/79] perf header: Fixup reading of HEADER_NRCPUS feature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 54/79] regmap: debugfs: Ensure we dont underflow when printing access masks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 08/79] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 46/79] usb: xhci: Clear XHCI_STATE_DYING on start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 41/79] disabling oplocks/leases via module parm enable_oplocks broken for SMB3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 37/79] dm raid: fix round up of default region size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 39/79] netfilter: ctnetlink: put back references to master ct and expect objects Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 63/79] staging: comedi: usbduxsigma: dont clobber ao_timer in command test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 35/79] staging: ion: fix corruption of ion_import_dma_buf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 49/79] Initialize msg/shm IPC objects before doing ipc_addid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 70/79] arm64: readahead: fault retry breaks mmap file read random detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 48/79] usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 52/79] cifs: use server timestamp for ntlmv2 authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 68/79] dcache: Handle escaped paths in prepend_path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 65/79] powerpc/MSI: Fix race condition in tearing down MSI interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
[PATCH 3.14 56/79] security: fix typo in security_task_prctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 34/79] dm btree: add ref counting ops for the leaves of top level btrees Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 13/79] dmaengine: dw: properly read DWC_PARAMS register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 76/79] dm cache: fix NULL pointer when switching from cleaner policy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 36/79] USB: option: add ZTE PIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 62/79] staging: comedi: usbduxsigma: dont clobber ai_timer in command test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 04/79] perf tools: Fix copying of /proc/kcore Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 30/79] ASoC: dwc: correct irq clear method Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 53/79] mtd: pxa3xx_nand: add a default chunk size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 72/79] fib_rules: Fix dump_rules() not to exit early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 78/79] mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 06/79] perf stat: Get correct cpu id for print_aggr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 58/79] usb: Add device quirk for Logitech PTZ cameras Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 74/79] jbd2: avoid infinite loop when destroying aborted journal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 27/79] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 55/79] regmap: debugfs: Dont bother actually printing when calculating max length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 29/79] ASoC: fix broken pxa SoC support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 59/79] USB: Add reset-resume quirk for two Plantronics usb headphones. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 33/79] Btrfs: update fix for read corruption of compressed and shared extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 61/79] arch,hexagon: Convert smp_mb__*() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 57/79] usb: Use the USB_SS_MULT() macro to get the burst multiplier. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 09/79] ARM: fix Thumb2 signal handling when ARMv6 is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 77/79] staging: speakup: fix speakup-r regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 05/79] perf hists: Update the column width for the "srcline" sort key Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 32/79] Btrfs: fix read corruption of compressed and shared extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 31/79] btrfs: skip waiting on ordered range for special files Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 03/79] iser-target: remove command with state ISTATE_REMOVE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 75/79] clk: ti: fix dual-registration of uart4_ick Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 25/79] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 71/79] m68k: Define asmlinkage_protect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 60/79] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 28/79] ASoC: pxa: pxa2xx-ac97: fix dma requestor lines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 73/79] genirq: Fix race in register_irq_proc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
[PATCH 3.14 10/79] ARM: 8429/1: disable GCC SRA optimization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 18/79] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 22/79] sched/core: Fix TASK_DEAD race in finish_task_switch() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 14/79] x86/apic: Serialize LVTT and TSC_DEADLINE writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 21/79] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 26/79] ALSA: synth: Fix conflicting OSS device registration on AWE32 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 01/79] kvm: fix zero length mmio searching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 20/79] x86/mm: Set NX on gap between __ex_table and rodata Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 12/79] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 15/79] x86/platform: Fix Geode LX timekeeping in the generic x86 build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 11/79] windfarm: decrement client count when unregistering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 23/79] spi: Fix documentation of spi_alloc_master() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 02/79] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 17/79] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
[PATCH 3.14 24/79] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:50 +0200
[PATCH 3.14 19/79] x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:50 +0200
Re: [PATCH 3.14 00/79] 3.14.55-stable review Guenter Roeck <linux@roeck-us.net> - 2015-10-19 06:20 +0200
Re: [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-19 17:20 +0200
Re: [PATCH 3.14 00/79] 3.14.55-stable review Richard Kuo <rkuo@codeaurora.org> - 2015-10-19 21:20 +0200
Re: [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-19 22:10 +0200
Re: [PATCH 3.14 00/79] 3.14.55-stable review Richard Kuo <rkuo@codeaurora.org> - 2015-10-19 23:40 +0200
Re: [PATCH 3.14 00/79] 3.14.55-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-10-19 17:30 +0200
csiph-web