lkml.org 
[lkml]   [2013]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 029/149] rculist: list_first_or_null_rcu() should use list_entry_rcu()
    3.2.52-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Tejun Heo <tj@kernel.org>

    commit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream.

    list_first_or_null() should test whether the list is empty and return
    pointer to the first entry if not in a RCU safe manner. It's broken
    in several ways.

    * It compares __kernel @__ptr with __rcu @__next triggering the
    following sparse warning.

    net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces)

    * It doesn't perform rcu_dereference*() and computes the entry address
    using container_of() directly from the __rcu pointer which is
    inconsitent with other rculist interface. As a result, all three
    in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They
    dereference the pointer w/o going through read barrier.

    * While ->next dereference passes through list_next_rcu(), the
    compiler is still free to fetch ->next more than once and thus
    nullify the "__ptr != __next" condition check.

    Fix it by making list_first_or_null_rcu() dereference ->next directly
    using ACCESS_ONCE() and then use list_entry_rcu() on it like other
    rculist accessors.

    v2: Paul pointed out that the compiler may fetch the pointer more than
    once nullifying the condition check. ACCESS_ONCE() added on
    ->next dereference.

    v3: Restored () around macro param which was accidentally removed.
    Spotted by Paul.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Cc: Dipankar Sarma <dipankar@in.ibm.com>
    Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Reviewed-by: Josh Triplett <josh@joshtriplett.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    include/linux/rculist.h | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/include/linux/rculist.h
    +++ b/include/linux/rculist.h
    @@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(
    */
    #define list_first_or_null_rcu(ptr, type, member) \
    ({struct list_head *__ptr = (ptr); \
    - struct list_head __rcu *__next = list_next_rcu(__ptr); \
    - likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
    + struct list_head *__next = ACCESS_ONCE(__ptr->next); \
    + likely(__ptr != __next) ? \
    + list_entry_rcu(__next, type, member) : NULL; \
    })

    /**


    \
     
     \ /
      Last update: 2013-10-21 11:41    [W:4.181 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site