Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-27 05:11:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

rhashtable: Fix walker list corruption

Browse Source 
The commit ba7c95ea38 ("rhashtable:
Fix sleeping inside RCU critical section in walk_stop") introduced
a new spinlock for the walker list.  However, it did not convert
all existing users of the list over to the new spin lock.  Some
continued to use the old mutext for this purpose.  This obviously
led to corruption of the list.

The fix is to use the spin lock everywhere where we touch the list.

This also allows us to do rcu_rad_lock before we take the lock in
rhashtable_walk_start.  With the old mutex this would've deadlocked
but it's safe with the new spin lock.

Fixes: ba7c95ea38 ("rhashtable: Fix sleeping inside RCU...")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2015-12-16 16:45:54 +08:00 committed by David S. Miller
parent 3a324606bb
commit c6ff526829
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/rhashtable.c
View File

@ -518,10 +518,10 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
if (!iter->walker) if (!iter->walker)
return -ENOMEM; return -ENOMEM;
mutex_lock(&ht->mutex); spin_lock(&ht->lock);
iter->walker->tbl = rht_dereference(ht->tbl, ht); iter->walker->tbl = rht_dereference(ht->tbl, ht);
list_add(&iter->walker->list, &iter->walker->tbl->walkers); list_add(&iter->walker->list, &iter->walker->tbl->walkers);
mutex_unlock(&ht->mutex); spin_unlock(&ht->lock);
return 0; return 0;
} }
@ -535,10 +535,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
*/ */
void rhashtable_walk_exit(struct rhashtable_iter *iter) void rhashtable_walk_exit(struct rhashtable_iter *iter)
{ {
mutex_lock(&iter->ht->mutex); spin_lock(&iter->ht->lock);
if (iter->walker->tbl) if (iter->walker->tbl)
list_del(&iter->walker->list); list_del(&iter->walker->list);
mutex_unlock(&iter->ht->mutex); spin_unlock(&iter->ht->lock);
kfree(iter->walker); kfree(iter->walker);
} }
EXPORT_SYMBOL_GPL(rhashtable_walk_exit); EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
@ -562,14 +562,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
{ {
struct rhashtable *ht = iter->ht; struct rhashtable *ht = iter->ht;
mutex_lock(&ht->mutex);
if (iter->walker->tbl)
list_del(&iter->walker->list);
rcu_read_lock(); rcu_read_lock();
mutex_unlock(&ht->mutex); spin_lock(&ht->lock);
if (iter->walker->tbl)
list_del(&iter->walker->list);
spin_unlock(&ht->lock);
if (!iter->walker->tbl) { if (!iter->walker->tbl) {
iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht); iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);