From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Tony Luck <tony.luck@intel.com>
Subject: [60/80] IA64: fix siglock
Date: Fri, 24 Sep 2010 09:24:48 -0700 [thread overview]
Message-ID: <20100924162620.112460996@clark.site> (raw)
In-Reply-To: <20100924162706.GA7381@kroah.com>
2.6.35-stable review patch. If anyone has any objections, please let us know.
------------------
From: Tony Luck <tony.luck@intel.com>
commit f574c843191728d9407b766a027f779dcd27b272 upstream.
When ia64 converted to using ticket locks, an inline implementation
of trylock/unlock in fsys.S was missed. This was not noticed because
in most circumstances it simply resulted in using the slow path because
the siglock was apparently not available (under old spinlock rules).
Problems occur when the ticket spinlock has value 0x0 (when first
initialised, or when it wraps around). At this point the fsys.S
code acquires the lock (changing the 0x0 to 0x1. If another process
attempts to get the lock at this point, it will change the value from
0x1 to 0x2 (using new ticket lock rules). Then the fsys.S code will
free the lock using old spinlock rules by writing 0x0 to it. From
here a variety of bad things can happen.
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/ia64/kernel/fsys.S | 46 +++++++++++++++++++++++++++++++++++++++-------
1 file changed, 39 insertions(+), 7 deletions(-)
--- a/arch/ia64/kernel/fsys.S
+++ b/arch/ia64/kernel/fsys.S
@@ -424,14 +424,26 @@ EX(.fail_efault, ld8 r14=[r33]) // r14
andcm r14=r14,r17 // filter out SIGKILL & SIGSTOP
#ifdef CONFIG_SMP
- mov r17=1
- ;;
- cmpxchg4.acq r18=[r31],r17,ar.ccv // try to acquire the lock
+ // __ticket_spin_trylock(r31)
+ ld4 r17=[r31]
mov r8=EINVAL // default to EINVAL
;;
+ extr r9=r17,17,15
+ ;;
+ xor r18=r17,r9
+ adds r19=1,r17
+ ;;
+ extr.u r18=r18,0,15
+ ;;
+ cmp.eq p0,p7=0,r18
+(p7) br.cond.spnt.many .lock_contention
+ mov.m ar.ccv=r17
+ ;;
+ cmpxchg4.acq r9=[r31],r19,ar.ccv
+ ;;
+ cmp4.eq p0,p7=r9,r17
+(p7) br.cond.spnt.many .lock_contention
ld8 r3=[r2] // re-read current->blocked now that we hold the lock
- cmp4.ne p6,p0=r18,r0
-(p6) br.cond.spnt.many .lock_contention
;;
#else
ld8 r3=[r2] // re-read current->blocked now that we hold the lock
@@ -490,7 +502,17 @@ EX(.fail_efault, ld8 r14=[r33]) // r14
(p6) br.cond.spnt.few 1b // yes -> retry
#ifdef CONFIG_SMP
- st4.rel [r31]=r0 // release the lock
+ // __ticket_spin_unlock(r31)
+ adds r31=2,r31
+ ;;
+ ld2.bias r2=[r31]
+ mov r3=65534
+ ;;
+ adds r2=2,r2
+ ;;
+ and r3=r3,r2
+ ;;
+ st2.rel [r31]=r3
#endif
SSM_PSR_I(p0, p9, r31)
;;
@@ -512,7 +534,17 @@ EX(.fail_efault, (p15) st8 [r34]=r3)
.sig_pending:
#ifdef CONFIG_SMP
- st4.rel [r31]=r0 // release the lock
+ // __ticket_spin_unlock(r31)
+ adds r31=2,r31
+ ;;
+ ld2.bias r2=[r31]
+ mov r3=65534
+ ;;
+ adds r2=2,r2
+ ;;
+ and r3=r3,r2
+ ;;
+ st2.rel [r31]=r3
#endif
SSM_PSR_I(p0, p9, r17)
;;
next prev parent reply other threads:[~2010-09-24 16:33 UTC|newest]
Thread overview: 99+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-09-24 16:27 [00/80] 2.6.35.6 stable review Greg KH
2010-09-24 16:23 ` [01/80] usb: musb_debugfs: dont use the struct file private_data field with seq_files Greg KH
2010-09-24 16:23 ` [02/80] USB: serial/mos*: prevent reading uninitialized stack memory Greg KH
2010-09-24 16:23 ` [03/80] bridge: Clear INET control block of SKBs passed into ip_fragment() Greg KH
2010-09-24 16:23 ` [04/80] gro: fix different skb headrooms Greg KH
2010-09-24 16:23 ` [05/80] gro: Re-fix " Greg KH
2010-09-24 16:23 ` [06/80] irda: Correctly clean up self->ias_obj on irda_bind() failure Greg KH
2010-09-24 16:23 ` [07/80] rds: fix a leak of kernel memory Greg KH
2010-09-24 16:23 ` [08/80] net: RPS needs to depend upon USE_GENERIC_SMP_HELPERS Greg KH
2010-09-24 16:23 ` [09/80] tcp: Combat per-cpu skew in orphan tests Greg KH
2010-09-24 16:23 ` [10/80] tcp: fix three tcp sysctls tuning Greg KH
2010-09-24 16:23 ` [11/80] tcp: select(writefds) dont hang up when a peer close connection Greg KH
2010-09-24 16:24 ` [12/80] tcp: Prevent overzealous packetization by SWS logic Greg KH
2010-09-24 16:24 ` [13/80] udp: add rehash on connect() Greg KH
2010-09-24 16:24 ` [14/80] UNIX: Do not loop forever at unix_autobind() Greg KH
2010-09-24 16:24 ` [15/80] l2tp: test for ethernet header in l2tp_eth_dev_recv() Greg KH
2010-09-24 16:24 ` [16/80] net: blackhole route should always be recalculated Greg KH
2010-09-24 16:24 ` [17/80] sparc64: Get rid of indirect p1275 PROM call buffer Greg KH
2010-09-24 16:24 ` [18/80] drivers/net/usb/hso.c: prevent reading uninitialized memory Greg KH
2010-09-24 16:24 ` [19/80] drivers/net/cxgb3/cxgb3_main.c: prevent reading uninitialized stack memory Greg KH
2010-09-24 16:24 ` [20/80] drivers/net/eql.c: " Greg KH
2010-09-24 16:24 ` [21/80] bonding: correctly process non-linear skbs Greg KH
2010-09-24 16:24 ` [22/80] Staging: vt6655: fix buffer overflow Greg KH
2010-09-24 16:24 ` [23/80] net/llc: make opt unsigned in llc_ui_setsockopt() Greg KH
2010-09-24 16:24 ` [24/80] mm: fix swapin race condition Greg KH
2010-09-24 16:24 ` [25/80] mm: further " Greg KH
2010-09-24 16:24 ` [26/80] virtio: console: Prevent userspace from submitting NULL buffers Greg KH
2010-09-24 16:24 ` [27/80] virtio: console: Fix poll blocking even though there is data to read Greg KH
2010-09-24 16:24 ` [28/80] intel_agp, drm/i915: Add all sandybridge graphics devices support Greg KH
2010-09-24 16:24 ` [29/80] agp/intel: fix physical address mask bits for sandybridge Greg KH
2010-09-24 16:24 ` [30/80] agp/intel: fix dma mask bits on sandybridge Greg KH
2010-09-24 16:24 ` [31/80] hw breakpoints: Fix pid namespace bug Greg KH
2010-09-24 16:24 ` [32/80] pid: make setpgid() system call use RCU read-side critical section Greg KH
2010-09-24 16:24 ` [33/80] sched: Fix user time incorrectly accounted as system time on 32-bit Greg KH
2010-09-24 16:24 ` [34/80] oprofile: Add Support for Intel CPU Family 6 / Model 22 (Intel Celeron 540) Greg KH
2010-09-24 16:24 ` [35/80] drm/i915,agp/intel: Add second set of PCI-IDs for B43 Greg KH
2010-09-24 16:24 ` [36/80] bdi: Initialize noop_backing_dev_info properly Greg KH
2010-09-24 16:24 ` [37/80] bdi: Fix warnings in __mark_inode_dirty for /dev/zero and friends Greg KH
2010-09-24 16:24 ` [38/80] char: Mark /dev/zero and /dev/kmem as not capable of writeback Greg KH
2010-09-24 16:24 ` [39/80] drivers/pci/intel-iommu.c: fix build with older gccs Greg KH
2010-09-24 16:24 ` [40/80] mmap: call unlink_anon_vmas() in __split_vma() in case of error Greg KH
2010-09-24 16:24 ` [41/80] drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory Greg KH
2010-09-24 16:24 ` [42/80] rtc: s3c: balance state changes of wakeup flag Greg KH
2010-09-24 16:24 ` [43/80] Prevent freeing uninitialized pointer in compat_do_readv_writev Greg KH
2010-09-24 16:24 ` [44/80] /proc/vmcore: fix seeking Greg KH
2010-09-24 16:24 ` [45/80] vmscan: check all_unreclaimable in direct reclaim path Greg KH
2010-09-24 16:24 ` [46/80] percpu: fix pcpu_last_unit_cpu Greg KH
2010-09-24 16:24 ` [47/80] aio: do not return ERESTARTSYS as a result of AIO Greg KH
2010-09-24 16:24 ` [48/80] aio: check for multiplication overflow in do_io_submit Greg KH
2010-09-24 16:24 ` [49/80] x86 platform drivers: hp-wmi Reorder event id processing Greg KH
2010-09-24 16:24 ` [50/80] GFS2: gfs2_logd should be using interruptible waits Greg KH
2010-09-24 16:24 ` [51/80] drm/nv50: initialize ramht_refs list for faked 0 channel Greg KH
2010-09-24 16:24 ` [52/80] inotify: send IN_UNMOUNT events Greg KH
2010-09-24 16:24 ` [53/80] SCSI: mptsas: fix hangs caused by ATA pass-through Greg KH
2010-09-27 17:47 ` John Drescher
2010-09-24 16:24 ` [54/80] KVM: Keep slot ID in memory slot structure Greg KH
2010-09-24 16:24 ` [55/80] KVM: Prevent internal slots from being COWed Greg KH
2010-09-24 16:24 ` [56/80] KVM: MMU: fix direct sps access corrupted Greg KH
2010-09-24 16:24 ` [57/80] KVM: x86: emulator: inc/dec can have lock prefix Greg KH
2010-09-24 16:24 ` [58/80] KVM: MMU: fix mmu notifier invalidate handler for huge spte Greg KH
2010-09-24 16:24 ` [59/80] KVM: VMX: Fix host GDT.LIMIT corruption Greg KH
2010-09-24 16:24 ` Greg KH [this message]
2010-09-24 16:24 ` [61/80] IA64: Optimize ticket spinlocks in fsys_rt_sigprocmask Greg KH
2010-09-24 16:24 ` [62/80] KEYS: Fix RCU no-lock warning in keyctl_session_to_parent() Greg KH
2010-09-24 16:24 ` [63/80] KEYS: Fix bug in keyctl_session_to_parent() if parent has no session keyring Greg KH
2010-09-24 16:24 ` [64/80] xfs: prevent reading uninitialized stack memory Greg KH
2010-09-24 16:24 ` [65/80] drivers/video/via/ioctl.c: " Greg KH
2010-09-24 16:24 ` [66/80] AT91: change dma resource index Greg KH
2010-09-24 16:24 ` [67/80] PM: Prevent waiting forever on asynchronous resume after failing suspend Greg KH
2010-09-24 16:24 ` [68/80] PM / Hibernate: Avoid hitting OOM during preallocation of memory Greg KH
2010-09-24 16:24 ` [69/80] x86, asm: Use a lower case name for the end macro in atomic64_386_32.S Greg KH
2010-09-24 16:24 ` [70/80] ALSA: hda - Fix beep frequency on IDT 92HD73xx and 92HD71Bxx codecs Greg KH
2010-09-24 16:24 ` [71/80] Fix call to replaced SuperIO functions Greg KH
2010-09-24 16:25 ` [72/80] dell-wmi: Add support for eject key on Dell Studio 1555 Greg KH
2010-09-24 16:25 ` [73/80] mm: page allocator: drain per-cpu lists after direct reclaim allocation fails Greg KH
2010-09-24 16:25 ` [74/80] mm: page allocator: calculate a better estimate of NR_FREE_PAGES when memory is low and kswapd is awake Greg KH
2010-09-24 16:25 ` [75/80] mm: page allocator: update free page counters after pages are placed on the free list Greg KH
2010-09-24 16:25 ` [76/80] guard page for stacks that grow upwards Greg KH
2010-09-24 16:25 ` [77/80] Fix unprotected access to task credentials in waitid() Greg KH
2010-09-24 16:25 ` [78/80] sctp: Do not reset the packet during sctp_packet_config() Greg KH
2010-09-24 16:25 ` [79/80] drm/i915: Ensure that the crtcinfo is populated during mode_fixup() Greg KH
2010-09-24 16:25 ` [80/80] alpha: Fix printk format errors Greg KH
2010-09-24 20:49 ` [00/80] 2.6.35.6 stable review Gene Heskett
2010-09-25 15:02 ` Greg KH
2010-09-25 15:16 ` Gene Heskett
2010-09-25 23:52 ` Gene Heskett
2010-09-25 16:49 ` Piotr Hosowicz
2010-09-25 17:24 ` Greg KH
2010-09-25 17:30 ` Piotr Hosowicz
2010-09-25 17:42 ` Greg KH
2010-09-25 17:52 ` Piotr Hosowicz
2010-09-26 11:32 ` Greg KH
2010-09-26 13:02 ` Piotr Hosowicz
2010-09-26 13:10 ` Sven Joachim
2010-09-26 13:15 ` Piotr Hosowicz
2010-09-25 17:34 ` Piotr Hosowicz
2010-09-25 17:41 ` Greg KH
2010-09-25 17:47 ` Piotr Hosowicz
2010-09-25 17:49 ` Piotr Hosowicz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100924162620.112460996@clark.site \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=tony.luck@intel.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).