Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1624308
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.18 095/145] padata: avoid race in reordering |
| Date | 2017-04-16 13:10 +0200 |
| Message-ID | <twQe5-2WB-3@gated-at.bofh.it> (permalink) |
| References | <twQ4p-2E7-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <Jason@zx2c4.com>
commit de5540d088fe97ad583cc7d396586437b32149a5 upstream.
Under extremely heavy uses of padata, crashes occur, and with list
debugging turned on, this happens instead:
[87487.298728] WARNING: CPU: 1 PID: 882 at lib/list_debug.c:33
__list_add+0xae/0x130
[87487.301868] list_add corruption. prev->next should be next
(ffffb17abfc043d0), but was ffff8dba70872c80. (prev=ffff8dba70872b00).
[87487.339011] [<ffffffff9a53d075>] dump_stack+0x68/0xa3
[87487.342198] [<ffffffff99e119a1>] ? console_unlock+0x281/0x6d0
[87487.345364] [<ffffffff99d6b91f>] __warn+0xff/0x140
[87487.348513] [<ffffffff99d6b9aa>] warn_slowpath_fmt+0x4a/0x50
[87487.351659] [<ffffffff9a58b5de>] __list_add+0xae/0x130
[87487.354772] [<ffffffff9add5094>] ? _raw_spin_lock+0x64/0x70
[87487.357915] [<ffffffff99eefd66>] padata_reorder+0x1e6/0x420
[87487.361084] [<ffffffff99ef0055>] padata_do_serial+0xa5/0x120
padata_reorder calls list_add_tail with the list to which its adding
locked, which seems correct:
spin_lock(&squeue->serial.lock);
list_add_tail(&padata->list, &squeue->serial.list);
spin_unlock(&squeue->serial.lock);
This therefore leaves only place where such inconsistency could occur:
if padata->list is added at the same time on two different threads.
This pdata pointer comes from the function call to
padata_get_next(pd), which has in it the following block:
next_queue = per_cpu_ptr(pd->pqueue, cpu);
padata = NULL;
reorder = &next_queue->reorder;
if (!list_empty(&reorder->list)) {
padata = list_entry(reorder->list.next,
struct padata_priv, list);
spin_lock(&reorder->lock);
list_del_init(&padata->list);
atomic_dec(&pd->reorder_objects);
spin_unlock(&reorder->lock);
pd->processed++;
goto out;
}
out:
return padata;
I strongly suspect that the problem here is that two threads can race
on reorder list. Even though the deletion is locked, call to
list_entry is not locked, which means it's feasible that two threads
pick up the same padata object and subsequently call list_add_tail on
them at the same time. The fix is thus be hoist that lock outside of
that block.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/padata.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -189,19 +189,20 @@ static struct padata_priv *padata_get_ne
reorder = &next_queue->reorder;
+ spin_lock(&reorder->lock);
if (!list_empty(&reorder->list)) {
padata = list_entry(reorder->list.next,
struct padata_priv, list);
- spin_lock(&reorder->lock);
list_del_init(&padata->list);
atomic_dec(&pd->reorder_objects);
- spin_unlock(&reorder->lock);
pd->processed++;
+ spin_unlock(&reorder->lock);
goto out;
}
+ spin_unlock(&reorder->lock);
if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) {
padata = ERR_PTR(-ENODATA);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 099/145] drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 032/145] selinux: fix off-by-one in setprocattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 140/145] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 041/145] [PATCH 087/760] net: pktgen: remove rcu locking in pktgen_change_name() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 084/145] usb: dwc3: gadget: make Set Endpoint Configuration macros safe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 143/145] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 125/145] KVM: s390: Fix guest migration for huge guests resulting in panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 104/145] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 095/145] padata: avoid race in reordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 083/145] usb: gadget: dummy_hcd: clear usb_gadget region before registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 129/145] USB: uss720: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 132/145] USB: wusbcore: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 109/145] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 141/145] net: fix socket refcounting in skb_complete_wifi_ack() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 101/145] cpmac: remove hopeless #warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 110/145] net/packet: fix overflow in check for priv area size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 117/145] crypto: cryptd - Assign statesize properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 098/145] drm/ast: Call open_key before enable_mmio in POST code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 078/145] libceph: use BUG() instead of BUG_ON(1) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 123/145] s390: make setup_randomness work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 075/145] nlm: Ensure callback code also checks that the files match Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 130/145] USB: lvtest: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 137/145] MIPS: DEC: Avoid la pseudo-instruction in delay slots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 139/145] libceph: dont set weight to IN when OSD is destroyed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 111/145] usb: hub: Wait for connection to be reestablished after port reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 094/145] dm: flush queued bios when process blocks to avoid deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 082/145] mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 135/145] MIPS: ip27: Disable qlge driver in defconfig Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 091/145] USB: serial: io_ti: fix NULL-deref in interrupt callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 118/145] crypto: mcryptd - Fix load failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 122/145] s390: TASK_SIZE for kernel threads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 115/145] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 106/145] ipv4: mask tos for input route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 134/145] USB: fix linked-list corruption in rh_call_control() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 102/145] tracing: Add #undef to fix compile error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 136/145] MIPS: ip22: Fix ip28 build for modern gcc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 052/145] drivers: staging: nvec: remove bogus reset command for PS/2 interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 042/145] [PATCH 091/760] ipv4: disable BH in set_ping_group_range() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 090/145] USB: iowarrior: fix NULL-deref in write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 035/145] [PATCH 074/760] tcp: fix a compile error in DBGUNDO() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 060/145] lib/vsprintf.c: improve sanity check in vsnprintf() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 030/145] pwm: Unexport children before chip removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 068/145] staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 071/145] Bluetooth: Add another AR3012 04ca:3018 device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 057/145] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 087/145] USB: serial: safe_serial: fix information leak in completion handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 070/145] KVM: s390: Disable dirty log retrieval for UCONTROL guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 089/145] USB: iowarrior: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 046/145] [PATCH 083/760] netlink: do not enter direct reclaim from netlink_dump() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 065/145] xfrm: policy: init locks early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 074/145] USB: serial: digi_acceleport: fix OOB-event processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 076/145] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 007/145] ipv4: keep skb->dst around in presence of IP options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 050/145] coredump: fix unfreezable coredumping task Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 043/145] [PATCH 093/760] net: sctp, forbid negative length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 072/145] IB/ipoib: Fix deadlock between rmmod and set_mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 069/145] serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 047/145] ASoC: cs4270: fix DAPM stream name mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 054/145] USB: cdc-acm: fix TIOCMIWAIT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 036/145] [PATCH 075/760] ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 005/145] tcp: fix 0 divide in __tcp_select_window() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 085/145] usb: gadget: function: f_fs: pass companion descriptor along Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 063/145] cancel the setfilesize transation when io error happen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 051/145] staging: iio: ad5933: avoid uninitialized variable in error case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 064/145] raid10: increment write counter after bio is split Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 059/145] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 037/145] [PATCH 076/760] ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 049/145] swapfile: fix memory corruption via malformed swapfile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 062/145] tty: n_hdlc: get rid of racy n_hdlc.tbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 028/145] smc91x: avoid self-comparison warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 015/145] [PATCH 084/760] ipv6: tcp: restore IP6CB for pktoptions skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 012/145] ping: fix a null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 020/145] tcp: fix overflow in __tcp_retransmit_skb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 019/145] usb: chipidea: move the lock initialization to core file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 002/145] can: Fix kernel panic at security_sock_rcv_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 031/145] HID: usbhid: add ATEN CS962 to list of quirky devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 027/145] drm/exynos: fix error handling in exynos_drm_subdrv_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 033/145] fbdev: color map copying bounds checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 023/145] ALSA: usb-audio: Add quirk for Syntek STK1160 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-17 01:40 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 09:00 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Amit Pundir <amit.pundir@linaro.org> - 2017-04-17 10:10 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 10:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-17 20:20 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-18 07:00 +0200
csiph-web