Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1575640

[PATCH 4.4 20/29] percpu-refcount: fix reference leak during percpu-atomic transition

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Douglas Miller <dougmill@linux.vnet.ibm.com>

commit 966d2b04e070bc040319aaebfec09e0144dc3341 upstream.

percpu_ref_tryget() and percpu_ref_tryget_live() should return
"true" IFF they acquire a reference. But the return value from
atomic_long_inc_not_zero() is a long and may have high bits set,
e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines
is bool so the reference may actually be acquired but the routines
return "false" which results in a reference leak since the caller
assumes it does not need to do a corresponding percpu_ref_put().

This was seen when performing CPU hotplug during I/O, as hangs in
blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start)
raced with percpu_ref_tryget (blk_mq_timeout_work).
Sample stack trace:

__switch_to+0x2c0/0x450
__schedule+0x2f8/0x970
schedule+0x48/0xc0
blk_mq_freeze_queue_wait+0x94/0x120
blk_mq_queue_reinit_work+0xb8/0x180
blk_mq_queue_reinit_prepare+0x84/0xa0
cpuhp_invoke_callback+0x17c/0x600
cpuhp_up_callbacks+0x58/0x150
_cpu_up+0xf0/0x1c0
do_cpu_up+0x120/0x150
cpu_subsys_online+0x64/0xe0
device_online+0xb4/0x120
online_store+0xb4/0xc0
dev_attr_store+0x68/0xa0
sysfs_kf_write+0x80/0xb0
kernfs_fop_write+0x17c/0x250
__vfs_write+0x6c/0x1e0
vfs_write+0xd0/0x270
SyS_write+0x6c/0x110
system_call+0x38/0xe0

Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS,
and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests.
However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0
and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set.

The fix is to make the tryget routines use an actual boolean internally instead
of the atomic long result truncated to a int.

Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints
Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751
Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com>
Reviewed-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/percpu-refcount.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -206,7 +206,7 @@ static inline void percpu_ref_get(struct
 static inline bool percpu_ref_tryget(struct percpu_ref *ref)
 {
 	unsigned long __percpu *percpu_count;
-	int ret;
+	bool ret;
 
 	rcu_read_lock_sched();
 
@@ -240,7 +240,7 @@ static inline bool percpu_ref_tryget(str
 static inline bool percpu_ref_tryget_live(struct percpu_ref *ref)
 {
 	unsigned long __percpu *percpu_count;
-	int ret = false;
+	bool ret = false;
 
 	rcu_read_lock_sched();
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/29] 4.4.48-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 23/29] USB: serial: qcserial: add Dell DW5570 QDL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 13/29] svcrpc: fix oops in absence of krb5 module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 07/29] perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 29/29] base/memory, hotplug: fix a kernel oops in show_valid_zones() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 20/29] percpu-refcount: fix reference leak during percpu-atomic transition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 18/29] can: bcm: fix hrtimer/tasklet termination in bcm op removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 24/29] USB: serial: pl2303: add ATEN device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 08/29] ata: sata_mv:- Handle return value of devm_ioremap. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 11/29] powerpc: Add missing error check to prom_find_boot_cpu() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 21/29] HID: wacom: Fix poor prox handling in wacom_pl_irq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 03/29] drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 28/29] x86/irq: Make irq activate operations symmetric Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 02/29] ext4: validate s_first_meta_bg at mount time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 15/29] cifs: initialize file_info_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 26/29] usb: gadget: f_fs: Assorted buffer overflow checks. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 04/29] drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 01/29] PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 14/29] zswap: disable changing params if init fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 16/29] mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 12/29] NFSD: Fix a null reference case in find_or_create_lock_stateid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 19/29] mmc: sdhci: Ignore unexpected CARD_INT interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  Re: [PATCH 4.4 00/29] 4.4.48-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-07 17:00 +0100
  Re: [PATCH 4.4 00/29] 4.4.48-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-07 22:50 +0100
  Re: [PATCH 4.4 00/29] 4.4.48-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-08 07:40 +0100
    Re: [PATCH 4.4 00/29] 4.4.48-stable review Kevin Hilman <khilman@baylibre.com> - 2017-02-08 20:50 +0100
      Re: [PATCH 4.4 00/29] 4.4.48-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-08 21:10 +0100

csiph-web