On Fri, May 03, 2013 at 03:06:36PM +0800, wangbiao wrote: > From: "wang, biao" <biao.w...@intel.com> > Date: Fri, 3 May 2013 14:18:34 +0800 > Subject: [PATCH] klist: del waiter from klist_remove_waiters before wakeup > waitting process > > There is a race between klist_remove and klist_release. klist_remove > uses a local var waiter saved on stack. When klist_release calls > wake_up_process(waiter->process) to wake up the waiter, waiter might run > immediately and reuse the stack. Then, klist_release calls > list_del(&waiter->list) to change previous > wait data and cause prior waiter thread corrupt. > > The patch fixes it against kernel 3.9.
I've never seen that code before in my life; but after a quick look you appear to be completely right. > Signed-off-by: wang, biao <biao.w...@intel.com> Acked-by: Peter Zijlstra <a.p.zijls...@chello.nl> > --- > lib/klist.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/lib/klist.c b/lib/klist.c > index 0874e41..358a368 100644 > --- a/lib/klist.c > +++ b/lib/klist.c > @@ -193,10 +193,10 @@ static void klist_release(struct kref *kref) > if (waiter->node != n) > continue; > > + list_del(&waiter->list); > waiter->woken = 1; > mb(); > wake_up_process(waiter->process); > - list_del(&waiter->list); > } > spin_unlock(&klist_remove_lock); > knode_set_klist(n, NULL); > -- > 1.7.6 > > > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
