lkml.org 
[lkml]   [2018]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 230/241] fs/aio: Add explicit RCU grace period when freeing kioctx
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Tejun Heo <tj@kernel.org>

    commit a6d7cff472eea87d96899a20fa718d2bab7109f3 upstream.

    While fixing refcounting, e34ecee2ae79 ("aio: Fix a trinity splat")
    incorrectly removed explicit RCU grace period before freeing kioctx.
    The intention seems to be depending on the internal RCU grace periods
    of percpu_ref; however, percpu_ref uses a different flavor of RCU,
    sched-RCU. This can lead to kioctx being freed while RCU read
    protected dereferences are still in progress.

    Fix it by updating free_ioctx() to go through call_rcu() explicitly.

    v2: Comment added to explain double bouncing.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Jann Horn <jannh@google.com>
    Fixes: e34ecee2ae79 ("aio: Fix a trinity splat")
    Cc: Kent Overstreet <kent.overstreet@gmail.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: stable@vger.kernel.org # v3.13+
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/aio.c | 23 +++++++++++++++++++----
    1 file changed, 19 insertions(+), 4 deletions(-)

    --- a/fs/aio.c
    +++ b/fs/aio.c
    @@ -115,7 +115,8 @@ struct kioctx {
    struct page **ring_pages;
    long nr_pages;

    - struct work_struct free_work;
    + struct rcu_head free_rcu;
    + struct work_struct free_work; /* see free_ioctx() */

    /*
    * signals when all in-flight requests are done
    @@ -581,6 +582,12 @@ static int kiocb_cancel(struct aio_kiocb
    return cancel(&kiocb->common);
    }

    +/*
    + * free_ioctx() should be RCU delayed to synchronize against the RCU
    + * protected lookup_ioctx() and also needs process context to call
    + * aio_free_ring(), so the double bouncing through kioctx->free_rcu and
    + * ->free_work.
    + */
    static void free_ioctx(struct work_struct *work)
    {
    struct kioctx *ctx = container_of(work, struct kioctx, free_work);
    @@ -594,6 +601,14 @@ static void free_ioctx(struct work_struc
    kmem_cache_free(kioctx_cachep, ctx);
    }

    +static void free_ioctx_rcufn(struct rcu_head *head)
    +{
    + struct kioctx *ctx = container_of(head, struct kioctx, free_rcu);
    +
    + INIT_WORK(&ctx->free_work, free_ioctx);
    + schedule_work(&ctx->free_work);
    +}
    +
    static void free_ioctx_reqs(struct percpu_ref *ref)
    {
    struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
    @@ -602,8 +617,8 @@ static void free_ioctx_reqs(struct percp
    if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count))
    complete(&ctx->rq_wait->comp);

    - INIT_WORK(&ctx->free_work, free_ioctx);
    - schedule_work(&ctx->free_work);
    + /* Synchronize against RCU protected table->table[] dereferences */
    + call_rcu(&ctx->free_rcu, free_ioctx_rcufn);
    }

    /*
    @@ -825,7 +840,7 @@ static int kill_ioctx(struct mm_struct *
    table->table[ctx->id] = NULL;
    spin_unlock(&mm->ioctx_lock);

    - /* percpu_ref_kill() will do the necessary call_rcu() */
    + /* free_ioctx_reqs() will do the necessary RCU synchronization */
    wake_up_all(&ctx->wait);

    /*

    \
     
     \ /
      Last update: 2018-03-19 20:09    [W:4.019 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site