Messages in this thread | | | Date | Fri, 21 May 2021 10:18:53 -0400 | From | Johannes Weiner <> | Subject | Re: [PATCH v6] psi: fix race between psi_trigger_create/destroy |
| |
On Fri, May 21, 2021 at 10:05:54AM +0800, Huangzhaoyang wrote: > From: Zhaoyang Huang <zhaoyang.huang@unisoc.com> > > Race detected between psi_trigger_destroy/create as shown below, which > cause panic by accessing invalid psi_system->poll_wait->wait_queue_entry > and psi_system->poll_timer->entry->next. Under this modification, the > race window is removed by initialising poll_wait and poll_timer in > group_init which are executed only once at beginning. > > psi_trigger_destroy psi_trigger_create > mutex_lock(trigger_lock); > rcu_assign_pointer(poll_task, NULL); > mutex_unlock(trigger_lock); > mutex_lock(trigger_lock); > if (!rcu_access_pointer(group->poll_task)) { > > timer_setup(poll_timer, poll_timer_fn, 0); > > rcu_assign_pointer(poll_task, task); > } > mutex_unlock(trigger_lock); > > synchronize_rcu(); > del_timer_sync(poll_timer); <-- poll_timer has been reinitialized by > psi_trigger_create > > So, trigger_lock/RCU correctly protects destruction of group->poll_task but > misses this race affecting poll_timer and poll_wait. > > Fixes: 461daba06bdc ("psi: eliminate kthread_worker from psi trigger > scheduling mechanism") > > Signed-off-by: ziwei.dai <ziwei.dai@unisoc.com> > Signed-off-by: ke.wang <ke.wang@unisoc.com> > Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
| |