lkml.org 
[lkml]   [2015]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: sched: memory corruption on completing completions
On Wed, 04 Feb 2015 18:24:06 -0500 Sasha Levin <sasha.levin@oracle.com> wrote:

> Hi all,
>
> I was fuzzing with trinity on a -next kernel with the KASan patchset, and
> got what initially appeared to be a rather odd trace:
>
> ...
>
>
> I now have a theory for why it happens:
>
> Thread A Thread B
> ----------------------------------------------------------
>
> [Enter function]
> DECLARE_COMPLETION_ONSTACK(x)
> wait_for_completion(x)
> complete(x)
> [In complete(x):]
> spin_lock_irqsave(&x->wait.lock, flags);
> x->done++;
> __wake_up_locked(&x->wait, TASK_NORMAL, 1);
> [Done waiting, wakes up]
> [Exit function]
> spin_unlock_irqrestore(&x->wait.lock, flags);
>
>
>
> So the spin_unlock_irqrestore() at the end of complete() would proceed to corruption
> the stack of thread A.

But wait_for_completion() takes ->wait.lock as well, which should
provide the needed synchronization (__wait_for_common,
do_wait_for_common). I'm not seeing a hole in the logic, but it looks
like there might be one.


\
 
 \ /
  Last update: 2015-02-05 01:01    [W:0.543 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site