linux-kernel - [PATCH v2 1/1] percpu-refcount: do not forget to rcu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160810195539.6588-1-roman.penyaev@profitbricks.com>
Date:	Wed, 10 Aug 2016 21:55:39 +0200
From:	Roman Pen <roman.penyaev@...fitbricks.com>
To:	unlisted-recipients:; (no To-header on input)
Cc:	Roman Pen <roman.penyaev@...fitbricks.com>,
	Tejun Heo <tj@...nel.org>, linux-kernel@...r.kernel.org
Subject: [PATCH v2 1/1] percpu-refcount: do not forget to rcu_barrier() just before freeing

percpu issues some RCU callbacks to synchronize its state, so before
freeing we have to wait all those callbacks to finish.

E.g. the following simple sequence on stack causes nasty crash:

    struct percpu_ref ref;

    percpu_ref_init(&ref, release, 0, GFP_KERNEL);
    percpu_ref_kill(&ref);
    percpu_ref_exit(&ref);

Also this patch includes inition to NULL of confirm_switch callback.
Without this inition you have to zero out a chunk of memory or kernel
frightfully complains with WARN_ON_ONCE(ref->confirm_switch) at
__percpu_ref_switch_to_atomic.

Signed-off-by: Roman Pen <roman.penyaev@...fitbricks.com>
Cc: Tejun Heo <tj@...nel.org>
Cc: linux-kernel@...r.kernel.org
---
 v2:
   - just sending one more time because v1 was accidently
     sent as a reply to not related issue.

 lib/percpu-refcount.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
index 6111bcb..ddf934b 100644
--- a/lib/percpu-refcount.c
+++ b/lib/percpu-refcount.c
@@ -82,6 +82,7 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release,
 	atomic_long_set(&ref->count, start_count);
 
 	ref->release = release;
+	ref->confirm_switch = NULL;
 	return 0;
 }
 EXPORT_SYMBOL_GPL(percpu_ref_init);
@@ -101,6 +102,7 @@ void percpu_ref_exit(struct percpu_ref *ref)
 	unsigned long __percpu *percpu_count = percpu_count_ptr(ref);
 
 	if (percpu_count) {
+		rcu_barrier_sched();
 		free_percpu(percpu_count);
 		ref->percpu_count_ptr = __PERCPU_REF_ATOMIC_DEAD;
 	}
-- 
2.9.0