2018-08-11 13:19:58 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2023-03-04 22:45:27 -05:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2018-01-08 12:21:26 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2013-11-01 18:03:08 -07:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
2023-10-24 14:46:58 -04:00
|
|
|
|
|
|
|
|
|
2023-10-24 14:46:58 -04:00
|
|
|
|
|
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2013-07-10 18:04:21 -07:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2013-07-10 18:04:21 -07:00
|
|
|
|
2023-11-17 19:13:27 -05:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-10-24 14:46:58 -04:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2018-03-18 17:36:29 -07:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
|
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
2023-10-24 14:46:58 -04:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2018-03-18 17:36:29 -07:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
|
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
bcache: use llist_for_each_entry_safe() in __closure_wake_up()
Commit 09b3efec ("bcache: Don't reinvent the wheel but use existing llist
API") replaces the following while loop by llist_for_each_entry(),
-
- while (reverse) {
- cl = container_of(reverse, struct closure, list);
- reverse = llist_next(reverse);
-
+ llist_for_each_entry(cl, reverse, list) {
closure_set_waiting(cl, 0);
closure_sub(cl, CLOSURE_WAITING + 1);
}
This modification introduces a potential race by iterating a corrupted
list. Here is how it happens.
In the above modification, closure_sub() may wake up a process which is
waiting on reverse list. If this process decides to wait again by calling
closure_wait(), its cl->list will be added to another wait list. Then
when llist_for_each_entry() continues to iterate next node, it will travel
on another new wait list which is added in closure_wait(), not the
original reverse list in __closure_wake_up(). It is more probably to
happen on UP machine because the waked up process may preempt the process
which wakes up it.
Use llist_for_each_entry_safe() will fix the issue, the safe version fetch
next node before waking up a process. Then the copy of next node will make
sure list iteration stays on original reverse list.
Fixes: 09b3efec81de ("bcache: Don't reinvent the wheel but use existing llist API")
Signed-off-by: Coly Li <colyli@suse.de>
Reported-by: Michael Lyle <mlyle@lyle.org>
Reviewed-by: Byungchul Park <byungchul.park@lge.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2017-09-26 17:54:12 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-09-06 14:25:54 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
bcache: use llist_for_each_entry_safe() in __closure_wake_up()
Commit 09b3efec ("bcache: Don't reinvent the wheel but use existing llist
API") replaces the following while loop by llist_for_each_entry(),
-
- while (reverse) {
- cl = container_of(reverse, struct closure, list);
- reverse = llist_next(reverse);
-
+ llist_for_each_entry(cl, reverse, list) {
closure_set_waiting(cl, 0);
closure_sub(cl, CLOSURE_WAITING + 1);
}
This modification introduces a potential race by iterating a corrupted
list. Here is how it happens.
In the above modification, closure_sub() may wake up a process which is
waiting on reverse list. If this process decides to wait again by calling
closure_wait(), its cl->list will be added to another wait list. Then
when llist_for_each_entry() continues to iterate next node, it will travel
on another new wait list which is added in closure_wait(), not the
original reverse list in __closure_wake_up(). It is more probably to
happen on UP machine because the waked up process may preempt the process
which wakes up it.
Use llist_for_each_entry_safe() will fix the issue, the safe version fetch
next node before waking up a process. Then the copy of next node will make
sure list iteration stays on original reverse list.
Fixes: 09b3efec81de ("bcache: Don't reinvent the wheel but use existing llist API")
Signed-off-by: Coly Li <colyli@suse.de>
Reported-by: Michael Lyle <mlyle@lyle.org>
Reviewed-by: Byungchul Park <byungchul.park@lge.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2017-09-26 17:54:12 +08:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
|
|
|
|
|
2018-03-18 17:36:29 -07:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
2018-03-18 17:36:29 -07:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-10-24 14:46:58 -04:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2013-12-20 15:55:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2018-01-08 12:21:25 -08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-11-17 19:13:27 -05:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2023-11-17 19:13:27 -05:00
|
|
|
|
2019-09-03 21:25:45 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2018-01-08 12:21:25 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2018-01-08 12:21:26 -08:00
|
|
|
|
2018-01-08 12:21:25 -08:00
|
|
|
|
|
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2018-01-08 12:21:25 -08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2018-01-08 12:21:25 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2020-10-01 14:50:44 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
2018-08-11 13:19:45 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2018-08-11 13:19:51 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2018-01-08 12:21:25 -08:00
|
|
|
|
2015-10-05 14:39:52 +02:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2018-01-08 12:21:25 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
2018-08-11 13:19:51 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2020-10-01 14:50:44 +08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
|
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|
2013-03-23 16:11:31 -07:00
|
|
|
|
2017-03-17 16:35:23 -08:00
|
|
|
|