From: Tejun Heo <tj@kernel.org>
To: torvalds@linux-foundation.org, jannh@google.com,
paulmck@linux.vnet.ibm.com, bcrl@kvack.org,
viro@zeniv.linux.org.uk, kent.overstreet@gmail.com
Cc: security@kernel.org, linux-kernel@vger.kernel.org,
kernel-team@fb.com, Tejun Heo <tj@kernel.org>,
stable@vger.kernel.org
Subject: [PATCH 2/8] fs/aio: Use RCU accessors for kioctx_table->table[]
Date: Wed, 14 Mar 2018 12:45:09 -0700 [thread overview]
Message-ID: <20180314194515.1661824-2-tj@kernel.org> (raw)
In-Reply-To: <20180314194515.1661824-1-tj@kernel.org>
While converting ioctx index from a list to a table, db446a08c23d
("aio: convert the ioctx list to table lookup v3") missed tagging
kioctx_table->table[] as an array of RCU pointers and using the
appropriate RCU accessors. This introduces a small window in the
lookup path where init and access may race.
Mark kioctx_table->table[] with __rcu and use the approriate RCU
accessors when using the field.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Jann Horn <jannh@google.com>
Fixes: db446a08c23d ("aio: convert the ioctx list to table lookup v3")
Cc: Benjamin LaHaise <bcrl@kvack.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
---
fs/aio.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/fs/aio.c b/fs/aio.c
index eb2e0cf..6bcd3fb 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -68,9 +68,9 @@ struct aio_ring {
#define AIO_RING_PAGES 8
struct kioctx_table {
- struct rcu_head rcu;
- unsigned nr;
- struct kioctx *table[];
+ struct rcu_head rcu;
+ unsigned nr;
+ struct kioctx __rcu *table[];
};
struct kioctx_cpu {
@@ -330,7 +330,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
for (i = 0; i < table->nr; i++) {
struct kioctx *ctx;
- ctx = table->table[i];
+ ctx = rcu_dereference(table->table[i]);
if (ctx && ctx->aio_ring_file == file) {
if (!atomic_read(&ctx->dead)) {
ctx->user_id = ctx->mmap_base = vma->vm_start;
@@ -666,9 +666,9 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
while (1) {
if (table)
for (i = 0; i < table->nr; i++)
- if (!table->table[i]) {
+ if (!rcu_access_pointer(table->table[i])) {
ctx->id = i;
- table->table[i] = ctx;
+ rcu_assign_pointer(table->table[i], ctx);
spin_unlock(&mm->ioctx_lock);
/* While kioctx setup is in progress,
@@ -849,8 +849,8 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
}
table = rcu_dereference_raw(mm->ioctx_table);
- WARN_ON(ctx != table->table[ctx->id]);
- table->table[ctx->id] = NULL;
+ WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id]));
+ RCU_INIT_POINTER(table->table[ctx->id], NULL);
spin_unlock(&mm->ioctx_lock);
/* free_ioctx_reqs() will do the necessary RCU synchronization */
@@ -895,7 +895,8 @@ void exit_aio(struct mm_struct *mm)
skipped = 0;
for (i = 0; i < table->nr; ++i) {
- struct kioctx *ctx = table->table[i];
+ struct kioctx *ctx =
+ rcu_dereference_protected(table->table[i], true);
if (!ctx) {
skipped++;
@@ -1084,7 +1085,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
if (!table || id >= table->nr)
goto out;
- ctx = table->table[id];
+ ctx = rcu_dereference(table->table[id]);
if (ctx && ctx->user_id == ctx_id) {
percpu_ref_get(&ctx->users);
ret = ctx;
--
2.9.5
next prev parent reply other threads:[~2018-03-14 19:45 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-14 19:41 [PATCHSET v2] percpu_ref, RCU: Audit RCU usages in percpu_ref users Tejun Heo
2018-03-14 19:45 ` [PATCH 1/8] fs/aio: Add explicit RCU grace period when freeing kioctx Tejun Heo
2018-03-14 19:45 ` Tejun Heo [this message]
2018-03-14 19:45 ` [PATCH 3/8] RDMAVT: Fix synchronization around percpu_ref Tejun Heo
2018-03-15 22:24 ` Jason Gunthorpe
2018-03-14 19:45 ` [PATCH 4/8] HMM: Remove superflous RCU protection around radix tree lookup Tejun Heo
2018-03-26 14:54 ` Tejun Heo
2018-03-27 16:12 ` Jerome Glisse
2018-03-14 19:45 ` [PATCH 5/8] percpu_ref: Update doc to dissuade users from depending on internal RCU grace periods Tejun Heo
2018-03-19 17:10 ` Tejun Heo
2018-03-14 19:45 ` [PATCH 6/8] RCU, workqueue: Implement rcu_work Tejun Heo
2018-03-14 20:13 ` Paul E. McKenney
2018-03-16 6:01 ` Lai Jiangshan
2018-03-19 16:45 ` Tejun Heo
2018-03-20 10:04 ` Lai Jiangshan
2018-03-14 19:45 ` [PATCH 7/8] cgroup: Use rcu_work instead of explicit rcu and work item Tejun Heo
2018-03-14 19:45 ` [PATCH 8/8] fs/aio: " Tejun Heo
2018-03-19 17:12 ` Tejun Heo
2018-03-21 15:58 ` Oleg Nesterov
2018-03-21 16:40 ` Tejun Heo
2018-03-21 17:17 ` Oleg Nesterov
2018-03-21 17:53 ` Tejun Heo
2018-03-22 11:24 ` Oleg Nesterov
2018-03-26 15:04 ` Tejun Heo
2018-03-27 14:28 ` Oleg Nesterov
2018-03-27 15:55 ` Tejun Heo
2018-03-29 16:49 ` Oleg Nesterov
2018-03-29 17:41 ` Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180314194515.1661824-2-tj@kernel.org \
--to=tj@kernel.org \
--cc=bcrl@kvack.org \
--cc=jannh@google.com \
--cc=kent.overstreet@gmail.com \
--cc=kernel-team@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=paulmck@linux.vnet.ibm.com \
--cc=security@kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).