* [patch 17/18] drivers/hwspinlock: fix race between radix tree insertion and lookup
@ 2016-02-03 0:57 akpm
0 siblings, 0 replies; only message in thread
From: akpm @ 2016-02-03 0:57 UTC (permalink / raw)
To: torvalds, akpm, willy, hughd, khlebnikov, ohad, stable
From: Matthew Wilcox <willy@linux.intel.com>
Subject: drivers/hwspinlock: fix race between radix tree insertion and lookup
of_hwspin_lock_get_id() is protected by the RCU lock, which means that
insertions can occur simultaneously with the lookup. If the radix tree
transitions from a height of 0, we can see a slot with the indirect_ptr
bit set, which will cause us to at least read random memory, and could
cause other havoc.
Fix this by using the newly introduced radix_tree_iter_retry().
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ohad Ben-Cohen <ohad@wizery.com>
Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
drivers/hwspinlock/hwspinlock_core.c | 4 ++++
1 file changed, 4 insertions(+)
diff -puN drivers/hwspinlock/hwspinlock_core.c~hwspinlock-fix-race-between-radix-tree-insertion-and-lookup drivers/hwspinlock/hwspinlock_core.c
--- a/drivers/hwspinlock/hwspinlock_core.c~hwspinlock-fix-race-between-radix-tree-insertion-and-lookup
+++ a/drivers/hwspinlock/hwspinlock_core.c
@@ -313,6 +313,10 @@ int of_hwspin_lock_get_id(struct device_
hwlock = radix_tree_deref_slot(slot);
if (unlikely(!hwlock))
continue;
+ if (radix_tree_is_indirect_ptr(hwlock)) {
+ slot = radix_tree_iter_retry(&iter);
+ continue;
+ }
if (hwlock->bank->dev->of_node == args.np) {
ret = 0;
_
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2016-02-03 0:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-03 0:57 [patch 17/18] drivers/hwspinlock: fix race between radix tree insertion and lookup akpm
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.