All of lore.kernel.org
 help / color / mirror / Atom feed
* 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check()  without protection!
@ 2010-07-07  0:25 Miles Lane
  2010-07-07  4:34 ` Eric Dumazet
  0 siblings, 1 reply; 3+ messages in thread
From: Miles Lane @ 2010-07-07  0:25 UTC (permalink / raw)
  To: Paul E. McKenney, LKML

 [ INFO: suspicious rcu_dereference_check() usage. ]
 ---------------------------------------------------
 include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection!

 other info that might help us debug this:

 rcu_scheduler_active = 1, debug_locks = 1
 no locks held by compiz/4286.

 stack backtrace:
 Pid: 4286, comm: compiz Not tainted 2.6.35-rc4 #6
 Call Trace:
  [<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
  [<ffffffff810d3bdd>] fcheck_files+0x5c/0xca
  [<ffffffff810d3ca3>] fget_light+0x35/0x96
  [<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
  [<ffffffff810e1316>] ? __pollwait+0x0/0xc7
  [<ffffffff810e13dd>] ? pollwake+0x0/0x4f
  [<ffffffff8125b785>] ? __sock_sendmsg+0x66/0x72
  [<ffffffff8125da9e>] ? sock_aio_write+0x0/0xf6
  [<ffffffff8125db7f>] ? sock_aio_write+0xe1/0xf6
  [<ffffffff810d295f>] ? do_sync_readv_writev+0xbc/0xfb
  [<ffffffff810d284f>] ? fsnotify_modify+0x67/0x6f
  [<ffffffff810d35eb>] ? do_readv_writev+0x109/0x122
  [<ffffffff81009cba>] ? sysret_check+0x2e/0x69
  [<ffffffff810e1e7c>] sys_poll+0x50/0xba
  [<ffffffff81009c82>] system_call_fastpath+0x16/0x1b

===============================================================================

 [ INFO: suspicious rcu_dereference_check() usage. ]
 ---------------------------------------------------
 include/linux/fdtable.h:88 invoked rcu_dereference_check() without protection!

 other info that might help us debug this:

 rcu_scheduler_active = 1, debug_locks = 1
 no locks held by gnome-panel/4293.

 stack backtrace:
 Pid: 4293, comm: gnome-panel Not tainted 2.6.35-rc4 #6
 Call Trace:
  [<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
  [<ffffffff810d3c32>] fcheck_files+0xb1/0xca
  [<ffffffff810ab263>] ? might_fault+0x63/0xb3
  [<ffffffff810d3ca3>] fget_light+0x35/0x96
  [<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
  [<ffffffff810e1316>] ? __pollwait+0x0/0xc7
  [<ffffffff8125a2ae>] ? __sock_recvmsg_nosec+0x65/0x6e
  [<ffffffff8125b7da>] ? __sock_recvmsg+0x49/0x54
  [<ffffffff8125da8a>] ? sock_aio_read+0xe8/0xfc
  [<ffffffff810d2b67>] ? do_sync_read+0xc6/0x103
  [<ffffffff81009cba>] ? sysret_check+0x2e/0x69
  [<ffffffff810e1e7c>] sys_poll+0x50/0xba
  [<ffffffff81009c82>] system_call_fastpath+0x16/0x1b

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check()  without protection!
  2010-07-07  0:25 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection! Miles Lane
@ 2010-07-07  4:34 ` Eric Dumazet
  2010-07-07  4:37   ` Eric Dumazet
  0 siblings, 1 reply; 3+ messages in thread
From: Eric Dumazet @ 2010-07-07  4:34 UTC (permalink / raw)
  To: Miles Lane; +Cc: Paul E. McKenney, LKML

Le mardi 06 juillet 2010 à 20:25 -0400, Miles Lane a écrit :
> [ INFO: suspicious rcu_dereference_check() usage. ]
>  ---------------------------------------------------
>  include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection!
> 
>  other info that might help us debug this:
> 
>  rcu_scheduler_active = 1, debug_locks = 1
>  no locks held by compiz/4286.
> 
>  stack backtrace:
>  Pid: 4286, comm: compiz Not tainted 2.6.35-rc4 #6
>  Call Trace:
>   [<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
>   [<ffffffff810d3bdd>] fcheck_files+0x5c/0xca
>   [<ffffffff810d3ca3>] fget_light+0x35/0x96
>   [<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
>   [<ffffffff810e1316>] ? __pollwait+0x0/0xc7
>   [<ffffffff810e13dd>] ? pollwake+0x0/0x4f
>   [<ffffffff8125b785>] ? __sock_sendmsg+0x66/0x72
>   [<ffffffff8125da9e>] ? sock_aio_write+0x0/0xf6
>   [<ffffffff8125db7f>] ? sock_aio_write+0xe1/0xf6
>   [<ffffffff810d295f>] ? do_sync_readv_writev+0xbc/0xfb
>   [<ffffffff810d284f>] ? fsnotify_modify+0x67/0x6f
>   [<ffffffff810d35eb>] ? do_readv_writev+0x109/0x122
>   [<ffffffff81009cba>] ? sysret_check+0x2e/0x69
>   [<ffffffff810e1e7c>] sys_poll+0x50/0xba
>   [<ffffffff81009c82>] system_call_fastpath+0x16/0x1b
> 
> ===============================================================================
> 
>  [ INFO: suspicious rcu_dereference_check() usage. ]
>  ---------------------------------------------------
>  include/linux/fdtable.h:88 invoked rcu_dereference_check() without protection!
> 
>  other info that might help us debug this:
> 
>  rcu_scheduler_active = 1, debug_locks = 1
>  no locks held by gnome-panel/4293.
> 
>  stack backtrace:
>  Pid: 4293, comm: gnome-panel Not tainted 2.6.35-rc4 #6
>  Call Trace:
>   [<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
>   [<ffffffff810d3c32>] fcheck_files+0xb1/0xca
>   [<ffffffff810ab263>] ? might_fault+0x63/0xb3
>   [<ffffffff810d3ca3>] fget_light+0x35/0x96
>   [<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
>   [<ffffffff810e1316>] ? __pollwait+0x0/0xc7
>   [<ffffffff8125a2ae>] ? __sock_recvmsg_nosec+0x65/0x6e
>   [<ffffffff8125b7da>] ? __sock_recvmsg+0x49/0x54
>   [<ffffffff8125da8a>] ? sock_aio_read+0xe8/0xfc
>   [<ffffffff810d2b67>] ? do_sync_read+0xc6/0x103
>   [<ffffffff81009cba>] ? sysret_check+0x2e/0x69
>   [<ffffffff810e1e7c>] sys_poll+0x50/0xba
>   [<ffffffff81009c82>] system_call_fastpath+0x16/0x1b
> --

Miles, you already posted this three times, and a fix is known.

BTW, I dont know why it's not already in, Paul submitted it several
times, but nobody cares.

http://kerneltrap.org/mailarchive/linux-kernel/2010/6/17/4584014

I am going to Ack it, maybe some other guys can help to.



^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check()  without protection!
  2010-07-07  4:34 ` Eric Dumazet
@ 2010-07-07  4:37   ` Eric Dumazet
  0 siblings, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2010-07-07  4:37 UTC (permalink / raw)
  To: Miles Lane; +Cc: Paul E. McKenney, LKML

Le mercredi 07 juillet 2010 à 06:34 +0200, Eric Dumazet a écrit :

> Miles, you already posted this three times, and a fix is known.
> 
> BTW, I dont know why it's not already in, Paul submitted it several
> times, but nobody cares.
> 
> http://kerneltrap.org/mailarchive/linux-kernel/2010/6/17/4584014
> 
> I am going to Ack it, maybe some other guys can help to.
> 

Ah, its in Andrew tree since 6 days, it should be sent to Linus promptly
now...

The patch titled
     vfs: fix RCU-lockdep false positive due to /proc
has been added to the -mm tree.  Its filename is
     vfs-fix-rcu-lockdep-false-positive-due-to-proc.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/SubmitChecklist when testing your code
***

See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this

The current -mm tree may be found at
http://userweb.kernel.org/~akpm/mmotm/

------------------------------------------------------
Subject: vfs: fix RCU-lockdep false positive due to /proc
From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>

If a single-threaded process does a file-descriptor operation, and some
other process accesses that same file descriptor via /proc, the current
rcu_dereference_check_fdtable() can give a false-positive RCU-lockdep
splat due to the reference count being increased by the /proc access
after
the reference-count check in fget_light() but before the check in
rcu_dereference_check_fdtable().

This commit prevents this false positive by checking for a
single-threaded
process.  To avoid #include hell, this commit uses the wrapper for
thread_group_empty(current) defined by rcu_my_thread_group_empty()
provided in a separate commit.

Located-by: Miles Lane <miles.lane@gmail.com>
Located-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/fdtable.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff -puN
include/linux/fdtable.h~vfs-fix-rcu-lockdep-false-positive-due-to-proc
include/linux/fdtable.h
---
a/include/linux/fdtable.h~vfs-fix-rcu-lockdep-false-positive-due-to-proc
+++ a/include/linux/fdtable.h
@@ -62,7 +62,8 @@ struct files_struct {
        (rcu_dereference_check((fdtfd), \
                               rcu_read_lock_held() || \
                               lockdep_is_held(&(files)->file_lock) || \
-                              atomic_read(&(files)->count) == 1))
+                              atomic_read(&(files)->count) == 1 || \
+                              rcu_my_thread_group_empty()))
 
 #define files_fdtable(files) \
                (rcu_dereference_check_fdtable((files), (files)->fdt))
_

Patches currently in -mm which might be from
paulmck@linux.vnet.ibm.com are

origin.patch
fs-fcntlc-kill_fasync_rcu-fa_lock-must-be-irq-safe.patch
linux-next.patch
vfs-fix-rcu-lockdep-false-positive-due-to-proc.patch
vfs-use-kmalloc-to-allocate-fdmem-if-possible.patch





^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-07-07  4:37 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-07-07  0:25 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection! Miles Lane
2010-07-07  4:34 ` Eric Dumazet
2010-07-07  4:37   ` Eric Dumazet

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.