Messages in this thread | | | Date | Thu, 10 Jun 2021 09:32:33 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH v6] psi: fix race between psi_trigger_create/destroy |
| |
On Thu, Jun 10, 2021 at 09:31:33AM +0200, Peter Zijlstra wrote: > On Fri, May 21, 2021 at 10:18:53AM -0400, Johannes Weiner wrote: > > On Fri, May 21, 2021 at 10:05:54AM +0800, Huangzhaoyang wrote: > > > From: Zhaoyang Huang <zhaoyang.huang@unisoc.com> > > > > > > Race detected between psi_trigger_destroy/create as shown below, which > > > cause panic by accessing invalid psi_system->poll_wait->wait_queue_entry > > > and psi_system->poll_timer->entry->next. Under this modification, the > > > race window is removed by initialising poll_wait and poll_timer in > > > group_init which are executed only once at beginning. > > > > > > psi_trigger_destroy psi_trigger_create > > > mutex_lock(trigger_lock); > > > rcu_assign_pointer(poll_task, NULL); > > > mutex_unlock(trigger_lock); > > > mutex_lock(trigger_lock); > > > if (!rcu_access_pointer(group->poll_task)) { > > > > > > timer_setup(poll_timer, poll_timer_fn, 0); > > > > > > rcu_assign_pointer(poll_task, task); > > > } > > > mutex_unlock(trigger_lock); > > > > > > synchronize_rcu(); > > > del_timer_sync(poll_timer); <-- poll_timer has been reinitialized by > > > psi_trigger_create > > > > > > So, trigger_lock/RCU correctly protects destruction of group->poll_task but > > > misses this race affecting poll_timer and poll_wait. > > > > > > Fixes: 461daba06bdc ("psi: eliminate kthread_worker from psi trigger > > > scheduling mechanism") > > > > > > Signed-off-by: ziwei.dai <ziwei.dai@unisoc.com> > > > Signed-off-by: ke.wang <ke.wang@unisoc.com> > > > Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Argh noticed the SoB chain is invalid. Please fix.
> > > > Acked-by: Johannes Weiner <hannes@cmpxchg.org> > > Thanks!
| |