RE: [PATCH] klist: del waiter from klist_remove_waiters beforewakeup waitting process

[Zhang, Yanmin]

Andrew,

Would you like to merge the patch to your MM tree?

Yanmin

>-----Original Message-----
>From: Peter Zijlstra [mailto:peterz@xxxxxxxxxxxxx]
>Sent: Friday, May 03, 2013 6:42 PM
>To: Wang, Biao
>Cc: akpm@xxxxxxxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx;
>mingo@xxxxxxxxxx; Zhang, Yanmin; mochel@xxxxxxxxxxxxxxxxxx
>Subject: Re: [PATCH] klist: del waiter from klist_remove_waiters before wakeup
>waitting process
>
>On Fri, May 03, 2013 at 03:06:36PM +0800, wangbiao wrote:
>> From: "wang, biao" <biao.wang@xxxxxxxxx>
>> Date: Fri, 3 May 2013 14:18:34 +0800
>> Subject: [PATCH] klist: del waiter from klist_remove_waiters before
>> wakeup  waitting process
>>
>> There is a race between klist_remove and klist_release. klist_remove
>> uses a local var waiter saved on stack. When klist_release calls
>> wake_up_process(waiter->process) to wake up the waiter, waiter might
>> run immediately and reuse the stack. Then, klist_release calls
>> list_del(&waiter->list) to change previous wait data and cause prior
>> waiter thread corrupt.
>>
>> The patch fixes it against kernel 3.9.
>
>
>I've never seen that code before in my life; but after a quick look you appear to
>be completely right.
>
>> Signed-off-by: wang, biao <biao.wang@xxxxxxxxx>
>
>Acked-by: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx>
>
>> ---
>>  lib/klist.c |    2 +-
>>  1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/lib/klist.c b/lib/klist.c index 0874e41..358a368 100644
>> --- a/lib/klist.c
>> +++ b/lib/klist.c
>> @@ -193,10 +193,10 @@ static void klist_release(struct kref *kref)
>>  		if (waiter->node != n)
>>  			continue;
>>
>> +		list_del(&waiter->list);
>>  		waiter->woken = 1;
>>  		mb();
>>  		wake_up_process(waiter->process);
>> -		list_del(&waiter->list);
>>  	}
>>  	spin_unlock(&klist_remove_lock);
>>  	knode_set_klist(n, NULL);
>> --
>> 1.7.6
>>
>>
>>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/