On 07/05/2017 04:27 PM, tip-bot for Kirill Tkhai wrote: > Commit-ID: a0c4acd2c220376b4e9690e75782d0c0afdaab9f > Gitweb: http://git.kernel.org/tip/a0c4acd2c220376b4e9690e75782d0c0afdaab9f > Author: Kirill Tkhai <ktk...@virtuozzo.com> > AuthorDate: Fri, 16 Jun 2017 16:44:34 +0300 > Committer: Ingo Molnar <mi...@kernel.org> > CommitDate: Wed, 5 Jul 2017 12:26:29 +0200 > > locking/rwsem-spinlock: Fix EINTR branch in __down_write_common() > > If a writer could been woken up, the above branch > > if (sem->count == 0) > break; > > would have moved us to taking the sem. So, it's > not the time to wake a writer now, and only readers > are allowed now. Thus, 0 must be passed to __rwsem_do_wake(). > > Next, __rwsem_do_wake() wakes readers unconditionally. > But we mustn't do that if the sem is owned by writer > in the moment. Otherwise, writer and reader own the sem > the same time, which leads to memory corruption in > callers. > > rwsem-xadd.c does not need that, as: > > 1) the similar check is made lockless there, > 2) in __rwsem_mark_wake::try_reader_grant we test, > > that sem is not owned by writer. > > Signed-off-by: Kirill Tkhai <ktk...@virtuozzo.com> > Acked-by: Peter Zijlstra <a.p.zijls...@chello.nl> > Cc: <sta...@vger.kernel.org> > Cc: Linus Torvalds <torva...@linux-foundation.org> > Cc: Niklas Cassel <niklas.cas...@axis.com> > Cc: Peter Zijlstra (Intel) <pet...@infradead.org> > Cc: Peter Zijlstra <pet...@infradead.org> > Cc: Thomas Gleixner <t...@linutronix.de> > Fixes: 17fcbd590d0c "locking/rwsem: Fix down_write_killable() for > CONFIG_RWSEM_GENERIC_SPINLOCK=y" > Link: > http://lkml.kernel.org/r/149762063282.19811.9129615532201147826.stgit@localhost.localdomain > Signed-off-by: Ingo Molnar <mi...@kernel.org> > --- > kernel/locking/rwsem-spinlock.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/kernel/locking/rwsem-spinlock.c b/kernel/locking/rwsem-spinlock.c > index c65f798..20819df 100644 > --- a/kernel/locking/rwsem-spinlock.c > +++ b/kernel/locking/rwsem-spinlock.c > @@ -231,8 +231,8 @@ int __sched __down_write_common(struct rw_semaphore *sem, > int state) > > out_nolock: > list_del(&waiter.list); > - if (!list_empty(&sem->wait_list)) > - __rwsem_do_wake(sem, 1); > + if (!list_empty(&sem->wait_list) && sem->count >= 0) > + __rwsem_do_wake(sem, 0); > raw_spin_unlock_irqrestore(&sem->wait_lock, flags); > > return -EINTR; >
For the record, there is actually a v2 of this: http://marc.info/?l=linux-kernel&m=149866422128912 Regards, Niklas
