diff options
| author | Lai Jiangshan <laijs@cn.fujitsu.com> | 2008-10-10 14:43:57 +0800 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2008-10-14 10:38:45 +0200 |
| commit | 1b7ae37c030a9fbbb5ebbf5d7bbfd7208cf805b7 (patch) | |
| tree | 9a7b2aa8074bd6189a89a4025fb2d96b712459c1 | |
| parent | 48043bcdf8f398d28e75ffed6ee85208d751f87f (diff) | |
| download | linux-stable-1b7ae37c030a9fbbb5ebbf5d7bbfd7208cf805b7.tar.gz linux-stable-1b7ae37c030a9fbbb5ebbf5d7bbfd7208cf805b7.tar.bz2 linux-stable-1b7ae37c030a9fbbb5ebbf5d7bbfd7208cf805b7.zip | |
markers: bit-field is not thread-safe nor smp-safe
bit-field is not thread-safe nor smp-safe.
struct marker_entry.rcu_pending is not protected by any lock
in rcu-callback free_old_closure().
so we must turn it into a safe type.
detail:
I suppose rcu_pending and ptype are store in struct marker_entry.tmp1
free_old_closure() side: change ptype side:
| load struct marker_entry.tmp1
--------------------------------|--------------------------------
| change ptype bit in tmp1
load struct marker_entry.tmp1 |
change rcu_pending bit in tmp1 |
store tmp1 |
--------------------------------|--------------------------------
| store tmp1
now this result equals that free_old_closure() do not change rcu_pending
bit, bug! This bug will cause redundant rcu_barrier_sched() called.
not too harmful.
----- corresponding:
free_old_closure() side: change ptype side:
load struct marker_entry.tmp1 |
--------------------------------|--------------------------------
| load struct marker_entry.tmp1
change rcu_pending bit in tmp1 |
| change ptype bit in tmp1
| store tmp1
--------------------------------|--------------------------------
store tmp1 |
now this result equals that change ptype side do not change ptype
bit, bug! this bug cause marker_probe_cb() access to invalid memory.
oops!
see also: http://en.wikipedia.org/wiki/Bit_field
Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
| -rw-r--r-- | kernel/marker.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/marker.c b/kernel/marker.c index 3b75d0e8b5a4..e9c6b2bc9400 100644 --- a/kernel/marker.c +++ b/kernel/marker.c @@ -62,7 +62,7 @@ struct marker_entry { int refcount; /* Number of times armed. 0 if disarmed. */ struct rcu_head rcu; void *oldptr; - unsigned char rcu_pending:1; + int rcu_pending; unsigned char ptype:1; char name[0]; /* Contains name'\0'format'\0' */ }; |