summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLai Jiangshan <laijs@cn.fujitsu.com>2008-10-10 14:43:57 +0800
committerIngo Molnar <mingo@elte.hu>2008-10-14 10:38:45 +0200
commit1b7ae37c030a9fbbb5ebbf5d7bbfd7208cf805b7 (patch)
tree9a7b2aa8074bd6189a89a4025fb2d96b712459c1
parent48043bcdf8f398d28e75ffed6ee85208d751f87f (diff)
downloadop-kernel-dev-1b7ae37c030a9fbbb5ebbf5d7bbfd7208cf805b7.zip
op-kernel-dev-1b7ae37c030a9fbbb5ebbf5d7bbfd7208cf805b7.tar.gz
markers: bit-field is not thread-safe nor smp-safe
bit-field is not thread-safe nor smp-safe. struct marker_entry.rcu_pending is not protected by any lock in rcu-callback free_old_closure(). so we must turn it into a safe type. detail: I suppose rcu_pending and ptype are store in struct marker_entry.tmp1 free_old_closure() side: change ptype side: | load struct marker_entry.tmp1 --------------------------------|-------------------------------- | change ptype bit in tmp1 load struct marker_entry.tmp1 | change rcu_pending bit in tmp1 | store tmp1 | --------------------------------|-------------------------------- | store tmp1 now this result equals that free_old_closure() do not change rcu_pending bit, bug! This bug will cause redundant rcu_barrier_sched() called. not too harmful. ----- corresponding: free_old_closure() side: change ptype side: load struct marker_entry.tmp1 | --------------------------------|-------------------------------- | load struct marker_entry.tmp1 change rcu_pending bit in tmp1 | | change ptype bit in tmp1 | store tmp1 --------------------------------|-------------------------------- store tmp1 | now this result equals that change ptype side do not change ptype bit, bug! this bug cause marker_probe_cb() access to invalid memory. oops! see also: http://en.wikipedia.org/wiki/Bit_field Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com> Acked-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> Signed-off-by: Ingo Molnar <mingo@elte.hu>
-rw-r--r--kernel/marker.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/marker.c b/kernel/marker.c
index 3b75d0e..e9c6b2b 100644
--- a/kernel/marker.c
+++ b/kernel/marker.c
@@ -62,7 +62,7 @@ struct marker_entry {
int refcount; /* Number of times armed. 0 if disarmed. */
struct rcu_head rcu;
void *oldptr;
- unsigned char rcu_pending:1;
+ int rcu_pending;
unsigned char ptype:1;
char name[0]; /* Contains name'\0'format'\0' */
};
OpenPOWER on IntegriCloud