Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit d9b2c8714aef102dea95544a8cd9372b21af463f

Authored by Artem Savkov
Committed by Benjamin LaHaise
1 parent d6c355c7da
Exists in smarc-imx_3.14.28_1.0.0_ga and in 1 other branch imx_3.14.28_1.0.0_ga

aio: rcu_read_lock protection for new rcu_dereference calls 

Patch "aio: fix rcu sparse warnings introduced by ioctx table lookup patch"
(77d30b14d24e557f89c41980011d72428514d729 in linux-next.git) introduced a
couple of new rcu_dereference calls which are not protected by rcu_read_lock
and result in following warnings during syscall fuzzing(trinity):

[  471.646379] ===============================
[  471.649727] [ INFO: suspicious RCU usage. ]
[  471.653919] 3.11.0-next-20130906+ #496 Not tainted
[  471.657792] -------------------------------
[  471.661235] fs/aio.c:503 suspicious rcu_dereference_check() usage!
[  471.665968]
[  471.665968] other info that might help us debug this:
[  471.665968]
[  471.672141]
[  471.672141] rcu_scheduler_active = 1, debug_locks = 1
[  471.677549] 1 lock held by trinity-child0/3774:
[  471.681675]  #0:  (&(&mm->ioctx_lock)->rlock){+.+...}, at: [<c119ba1a>] SyS_io_setup+0x63a/0xc70
[  471.688721]
[  471.688721] stack backtrace:
[  471.692488] CPU: 1 PID: 3774 Comm: trinity-child0 Not tainted 3.11.0-next-20130906+ #496
[  471.698437] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  471.703151]  00000000 00000000 c58bbf30 c18a814b de2234c0 c58bbf58 c10a4ec6 c1b0d824
[  471.709544]  c1b0f60e 00000001 00000001 c1af61b0 00000000 cb670ac0 c3aca000 c58bbfac
[  471.716251]  c119bc7c 00000002 00000001 00000000 c119b8dd 00000000 c10cf684 c58bbfb4
[  471.722902] Call Trace:
[  471.724859]  [<c18a814b>] dump_stack+0x4b/0x66
[  471.728772]  [<c10a4ec6>] lockdep_rcu_suspicious+0xc6/0x100
[  471.733716]  [<c119bc7c>] SyS_io_setup+0x89c/0xc70
[  471.737806]  [<c119b8dd>] ? SyS_io_setup+0x4fd/0xc70
[  471.741689]  [<c10cf684>] ? __audit_syscall_entry+0x94/0xe0
[  471.746080]  [<c18b1fcc>] syscall_call+0x7/0xb
[  471.749723]  [<c1080000>] ? task_fork_fair+0x240/0x260

Signed-off-by: Artem Savkov <artem.savkov@gmail.com>
Reviewed-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>

Showing 1 changed file with 6 additions and 0 deletions Side-by-side Diff

... ... @@ -479,6 +479,7 @@
479 479 struct aio_ring *ring;
480 480  
481 481 spin_lock(&mm->ioctx_lock);
  482 + rcu_read_lock();
482 483 table = rcu_dereference(mm->ioctx_table);
483 484  
484 485 while (1) {
... ... @@ -487,6 +488,7 @@
487 488 if (!table->table[i]) {
488 489 ctx->id = i;
489 490 table->table[i] = ctx;
  491 + rcu_read_unlock();
490 492 spin_unlock(&mm->ioctx_lock);
491 493  
492 494 ring = kmap_atomic(ctx->ring_pages[0]);
... ... @@ -497,6 +499,7 @@
497 499  
498 500 new_nr = (table ? table->nr : 1) * 4;
499 501  
  502 + rcu_read_unlock();
500 503 spin_unlock(&mm->ioctx_lock);
501 504  
502 505 table = kzalloc(sizeof(*table) + sizeof(struct kioctx *) *
... ... @@ -507,6 +510,7 @@
507 510 table->nr = new_nr;
508 511  
509 512 spin_lock(&mm->ioctx_lock);
  513 + rcu_read_lock();
510 514 old = rcu_dereference(mm->ioctx_table);
511 515  
512 516 if (!old) {
513 517  
... ... @@ -631,10 +635,12 @@
631 635 struct kioctx_table *table;
632 636  
633 637 spin_lock(&mm->ioctx_lock);
  638 + rcu_read_lock();
634 639 table = rcu_dereference(mm->ioctx_table);
635 640  
636 641 WARN_ON(ctx != table->table[ctx->id]);
637 642 table->table[ctx->id] = NULL;
  643 + rcu_read_unlock();
638 644 spin_unlock(&mm->ioctx_lock);
639 645  
640 646 /* percpu_ref_kill() will do the necessary call_rcu() */