Messages in this thread | | | Date | Fri, 21 May 2021 13:10:17 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH v6] psi: fix race between psi_trigger_create/destroy |
| |
On Thu, May 20, 2021 at 07:11:08PM -0700, Suren Baghdasaryan wrote: > On Thu, May 20, 2021 at 7:07 PM Huangzhaoyang <huangzhaoyang@gmail.com> wrote: > > > > From: Zhaoyang Huang <zhaoyang.huang@unisoc.com> > > > > Race detected between psi_trigger_destroy/create as shown below, which > > cause panic by accessing invalid psi_system->poll_wait->wait_queue_entry > > and psi_system->poll_timer->entry->next. Under this modification, the > > race window is removed by initialising poll_wait and poll_timer in > > group_init which are executed only once at beginning. > > > > psi_trigger_destroy psi_trigger_create > > mutex_lock(trigger_lock); > > rcu_assign_pointer(poll_task, NULL); > > mutex_unlock(trigger_lock); > > mutex_lock(trigger_lock); > > if (!rcu_access_pointer(group->poll_task)) { > > > > timer_setup(poll_timer, poll_timer_fn, 0); > > > > rcu_assign_pointer(poll_task, task); > > } > > mutex_unlock(trigger_lock); > > > > synchronize_rcu(); > > del_timer_sync(poll_timer); <-- poll_timer has been reinitialized by > > psi_trigger_create > > > > So, trigger_lock/RCU correctly protects destruction of group->poll_task but > > misses this race affecting poll_timer and poll_wait. > > > > Fixes: 461daba06bdc ("psi: eliminate kthread_worker from psi trigger > > scheduling mechanism") > > > > Signed-off-by: ziwei.dai <ziwei.dai@unisoc.com> > > Signed-off-by: ke.wang <ke.wang@unisoc.com> > > Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
This is not a valid SoB chain though; please (re)read Documentation/process/submitting-patches.rst.
> Looks good. Thanks! > Reviewed-by: Suren Baghdasaryan <surenb@google.com>
| |