Hello, Linus.
This pull request contains one patch to fix a race condition which can
lead to percpu_ref using a percpu pointer which is corrupted with a
set DEAD bit. The bug was introduced while separating out the ATOMIC
mode flag from the DEAD flag. The fix is pretty straight forward.
I just committed the patch to the percpu tree but am sending out the
pull request early as I'll be on vacation for a week. The patch
should be fairly safe and while the latency will be higher I'll be
checking emails.
Thanks.
The following changes since commit cac7f2429872d3733dc3f9915857b1691da2eb2f:
Linux 3.18-rc2 (2014-10-26 16:48:41 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu.git for-3.18-fixes
for you to fetch changes up to 4aab3b5b3ccf94fc907e66233e6ca4d8675759a6:
percpu-ref: fix DEAD flag contamination of percpu pointer (2014-11-23
12:36:06 -0500)
----------------------------------------------------------------
Tejun Heo (1):
percpu-ref: fix DEAD flag contamination of percpu pointer
include/linux/percpu-refcount.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index d5c89e0..51ce60c 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -133,7 +133,13 @@ static inline bool __ref_is_percpu(struct percpu_ref *ref,
/* paired with smp_store_release() in percpu_ref_reinit() */
smp_read_barrier_depends();
- if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC))
+ /*
+ * Theoretically, the following could test just ATOMIC; however,
+ * then we'd have to mask off DEAD separately as DEAD may be
+ * visible without ATOMIC if we race with percpu_ref_kill(). DEAD
+ * implies ATOMIC anyway. Test them together.
+ */
+ if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC_DEAD))
return false;
*percpu_countp = (unsigned long __percpu *)percpu_ptr;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
