> From: devel [mailto:driverdev-devel-boun...@linuxdriverproject.org] On > Behalf Of Dexuan Cui > Sent: Wednesday, May 18, 2016 11:44 > To: gre...@linuxfoundation.org; linux-ker...@vger.kernel.org; driverdev- > de...@linuxdriverproject.org; o...@aepfle.de; a...@canonical.com; > jasow...@redhat.com; KY Srinivasan <k...@microsoft.com>; > vkuzn...@redhat.com > Cc: Haiyang Zhang <haiya...@microsoft.com> > Subject: [PATCH v2] Drivers: hv: vmbus: fix the race when querying & > updating the percpu list > > There is a rare race when we remove an entry from the global list > hv_context.percpu_list[cpu] in hv_process_channel_removal() -> > percpu_channel_deq() -> list_del(): at this time, if vmbus_on_event() -> > process_chn_event() -> pcpu_relid2channel() is trying to query the list, > we can get the general protection fault: > > general protection fault: 0000 [#1] SMP > ... > RIP: 0010:[<ffffffff81461b6b>] [<ffffffff81461b6b>] > vmbus_on_event+0xc4/0x149 > > Similarly, we also have the issue in the code path: vmbus_process_offer() -> > percpu_channel_enq(). > > We can resolve the issue by disabling the tasklet when updating the list. > > Reported-by: Rolf Neugebauer <rolf.neugeba...@docker.com> > Cc: Vitaly Kuznetsov <vkuzn...@redhat.com> > Signed-off-by: Dexuan Cui <de...@microsoft.com> > --- > > v2: added tasklet_schedule() after tasklet_enable(). Thanks, Vitaly!
Please ignore the patch for now. I found an issue with the patch: after I moved percpu_channel_deq() from hv_process_channel_removal() to vmbus_close_internal(), the channel couldn't be removed from the per-cpu list, if the channel state was not CHANNEL_OPENED_STATE. I'll have to think about this and fix the issue in the next version. Thanks, -- Dexuan _______________________________________________ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
