linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Hugh Dickins <hugh@veritas.com>
To: Dawson Engler <engler@csl.stanford.edu>
Cc: linux-kernel@vger.kernel.org, <mc@cs.stanford.edu>
Subject: Re: [CHECKER] potential races in kernel/*.c mm/*.c net/*ipv4*.c
Date: Tue, 4 Mar 2003 12:24:23 +0000 (GMT)	[thread overview]
Message-ID: <Pine.LNX.4.44.0303041151090.10154-100000@localhost.localdomain> (raw)
In-Reply-To: <200303041112.h24BCRW22235@csl.stanford.edu>

On Tue, 4 Mar 2003, Dawson Engler wrote:
> 
> BUG? pair: lock=<struct shmem_inode_info.lock>, var=<struct shmem_inode_info.next_index>
>   z score=0.20
>   first = 2
>   1 error out of 6 uses:
>      /u2/engler/mc/oses/linux/linux-2.5.62/mm/shmem.c:385:shmem_truncate: ERROR: var <struct shmem_inode_info.next_index> not protected by <struct shmem_inode_info.lock>(pop=6, s=5) [locked=0] [seen_lock=1]
> 
>    seems like a potential race, since info_next_index seems like it could
>    get decreased in the meantime violating the if-stmt:
> 
>         if (idx >= info->next_index)
>                 return;
> 
>         spin_lock(&info->lock);
>         limit = info->next_index;

Thanks for the report, but this one is okay as is.

info->next_index is only ever _decreased_ here in this shmem_truncate
function, which is always entered under the protection of inode->i_sem
(which is guarding corresponding changes to inode->i_size).  As you've
noticed, it's okay if next_index increases before spin lock is taken.

Hugh


  reply	other threads:[~2003-03-04 12:12 UTC|newest]

Thread overview: 43+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-03-04 11:12 [CHECKER] potential races in kernel/*.c mm/*.c net/*ipv4*.c Dawson Engler
2003-03-04 12:24 ` Hugh Dickins [this message]
2003-03-04 13:23 ` Martin Josefsson
2003-03-21  6:33 ` [CHECKER] potential dereference of user pointer errors Junfeng Yang
2003-03-21 21:44   ` Chris Wright
2003-03-21 21:58     ` Junfeng Yang
2003-03-21 22:06       ` Chris Wright
2003-03-21 22:08     ` Junfeng Yang
2003-03-21 22:15   ` Chris Wright
2003-03-22 20:49     ` Alan Cox
2003-03-22 20:19       ` Chris Wright
2003-03-21 23:55   ` Chris Wright
2003-03-27  8:07     ` Jan Kasprzak
2003-03-27 17:10       ` Chris Wright
2003-04-21  7:49         ` [CHECKER] Help Needed! Junfeng Yang
2003-04-21 21:26           ` Chris Wright
2003-04-26  2:18             ` [CHECKER] 30 potential dereference of user-pointer errors Junfeng Yang
2003-04-27  9:26               ` James Morris
2003-04-28  1:55                 ` Junfeng Yang
2003-04-27 20:18               ` Nick Holloway
2003-04-27 21:14                 ` Junfeng Yang
2003-04-27 21:29               ` Junfeng Yang
2003-04-28  6:43               ` [CHECKER] 3 potential user-pointer errors in drivers/usb/serial that can print out arbitrary kernel data Junfeng Yang
2003-04-29  7:25                 ` Greg KH
2003-04-29  9:14                   ` Junfeng Yang
2003-04-28  6:50               ` [CHECKER] 8 potential user-pointer errors that allow arbitrary writes to kernel Junfeng Yang
2003-04-28 12:49                 ` Alan Cox
2003-04-28 19:11                   ` Junfeng Yang
2003-04-29  0:02                     ` [CHECKER] 5 potential user-pointer errors in write_proc Junfeng Yang
2003-04-29  7:26               ` [CHECKER] 30 potential dereference of user-pointer errors Greg KH
2003-03-22  0:15   ` [CHECKER] potential dereference of user pointer errors Chris Wright
2003-03-22  0:32     ` Greg KH
2003-03-22  0:47       ` Chris Wright
2003-03-22  1:00         ` Greg KH
2003-03-22  0:32   ` Chris Wright
2003-03-23 23:10   ` Junfeng Yang
2003-03-24  0:24     ` [CHECKER] 63 potential calling blocking functions with locks held errors Junfeng Yang
2003-03-24 12:35       ` [CHECKER] 8 potential calling blocking kmalloc(GFP_KERNEL) " Junfeng Yang
2003-03-24  0:29     ` [CHECKER] 1 potential double unlock error Junfeng Yang
2003-03-24  9:07     ` [CHECKER] potential dereference of user pointer errors Jaroslav Kysela
2003-03-24 22:28   ` Raja R Harinath
2003-03-25  0:44     ` David S. Miller
2003-03-25 18:52       ` Raja R Harinath

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Pine.LNX.4.44.0303041151090.10154-100000@localhost.localdomain \
    --to=hugh@veritas.com \
    --cc=engler@csl.stanford.edu \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mc@cs.stanford.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).