Commit ac5a2962b02f57dea76d314ef2521a2170b28ab6
Committed by
Greg Kroah-Hartman
1 parent
97521978c5
Exists in
master
and in
20 other branches
klist: del waiter from klist_remove_waiters before wakeup waitting process
There is a race between klist_remove and klist_release. klist_remove uses a local var waiter saved on stack. When klist_release calls wake_up_process(waiter->process) to wake up the waiter, waiter might run immediately and reuse the stack. Then, klist_release calls list_del(&waiter->list) to change previous wait data and cause prior waiter thread corrupt. The patch fixes it against kernel 3.9. Signed-off-by: wang, biao <biao.wang@intel.com> Acked-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff
lib/klist.c
... | ... | @@ -193,10 +193,10 @@ |
193 | 193 | if (waiter->node != n) |
194 | 194 | continue; |
195 | 195 | |
196 | + list_del(&waiter->list); | |
196 | 197 | waiter->woken = 1; |
197 | 198 | mb(); |
198 | 199 | wake_up_process(waiter->process); |
199 | - list_del(&waiter->list); | |
200 | 200 | } |
201 | 201 | spin_unlock(&klist_remove_lock); |
202 | 202 | knode_set_klist(n, NULL); |