Return-Path: <linux-rt-users-owner@vger.kernel.org>
Received: from rack3slot8.osadl.org (rack3slot8.osadl.org [127.0.0.1])
by rack3slot8.osadl.org (8.13.8/8.13.8/CE-2010120801) with ESMTP id r1DGiCL3011924
for <ce@thllin.ceag.ch>; Wed, 13 Feb 2013 17:44:13 +0100
Received: from toro.web-alm.net (uucp@localhost)
by rack3slot8.osadl.org (8.13.8/8.13.8/Submit) with bsmtp id r1DGiCgv011922
for ce@mailgate.computer-experts.de; Wed, 13 Feb 2013 17:44:12 +0100
Received: from www.osadl.org (www.osadl.org [62.245.132.105])
by toro.web-alm.net (8.12.11.20060308/8.12.11/Web-Alm-2003112001) with ESMTP id r1DGhfKW024153
for <ce@ceag.ch>; Wed, 13 Feb 2013 17:43:41 +0100
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by www.osadl.org (8.13.8/8.13.8/OSADL-2007092901) with ESMTP id r1DGhcfi002988
for <Carsten.Emde@osadl.org>; Wed, 13 Feb 2013 17:43:38 +0100
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S934423Ab3BMQlJ (ORCPT <rfc822;Carsten.Emde@osadl.org>);
Wed, 13 Feb 2013 11:41:09 -0500
Received: from www.linutronix.de ([62.245.132.108]:60029 "EHLO
Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S934352Ab3BMQlH (ORCPT
<rfc822;linux-rt-users@vger.kernel.org>);
Wed, 13 Feb 2013 11:41:07 -0500
Received: from localhost ([127.0.0.1] helo=localhost.localdomain)
by Galois.linutronix.de with esmtp (Exim 4.72)
(envelope-from <bigeasy@linutronix.de>)
id 1U5exR-0005iT-Iw; Wed, 13 Feb 2013 17:13:17 +0100
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
To: Steven Rostedt <rostedt@goodmis.org>
Cc: linux-kernel@vger.kernel.org, linux-rt-users@vger.kernel.org,
Carsten Emde <C.Emde@osadl.org>, Christoph Lameter <cl@linux.com>,
Pekka Enberg <penberg@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Subject: [PATCH 10/16] FIX [2/2] slub: Tid must be retrieved from the percpu area of the current processor
Date: Wed, 13 Feb 2013 17:12:05 +0100
Message-Id: <1360771932-27150-11-git-send-email-bigeasy@linutronix.de>
X-Mailer: git-send-email 1.7.10.4
In-Reply-To: <1360771932-27150-1-git-send-email-bigeasy@linutronix.de>
References: <1360771932-27150-1-git-send-email-bigeasy@linutronix.de>
X-Linutronix-Spam-Score: -1.0
X-Linutronix-Spam-Level: -
X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001
Sender: linux-rt-users-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-rt-users.vger.kernel.org>
X-Mailing-List: linux-rt-users@vger.kernel.org
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_LOW
autolearn=unavailable version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on rack3slot8.osadl.org
X-Virus-Scanned: ClamAV version 0.94.2, clamav-milter version 0.94.2 on rack3slot8.osadl.org
X-Virus-Status: Clean
From: Christoph Lameter <cl@linux.com>
As Steven Rostedt has pointer out: Rescheduling could occur on a differnet processor
after the determination of the per cpu pointer and before the tid is retrieved.
This could result in allocation from the wrong node in slab_alloc.
The effect is much more severe in slab_free() where we could free to the freelist
of the wrong page.
The window for something like that occurring is pretty small but it is possible.
Signed-off-by: Christoph Lameter <cl@linux.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
mm/slub.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
Index: linux-3.2.35-rt53/mm/slub.c
===================================================================
@ linux-3.2.35-rt53/mm/slub.c:2289 @ static __always_inline void *slab_alloc(
return NULL;
redo:
-
/*
* Must read kmem_cache cpu data via this cpu ptr. Preemption is
* enabled. We may switch back and forth between cpus while
* reading from one cpu area. That does not matter as long
* as we end up on the original cpu again when doing the cmpxchg.
+ *
+ * Preemption is disabled for the retrieval of the tid because that
+ * must occur from the current processor. We cannot allow rescheduling
+ * on a different processor between the determination of the pointer
+ * and the retrieval of the tid.
*/
+ preempt_disable();
c = __this_cpu_ptr(s->cpu_slab);
/*
@ linux-3.2.35-rt53/mm/slub.c:2310 @ redo:
* linked list in between.
*/
tid = c->tid;
- barrier();
+ preempt_enable();
object = c->freelist;
if (unlikely(!object || !node_match(c, node)))
@ linux-3.2.35-rt53/mm/slub.c:2552 @ redo:
* data is retrieved via this pointer. If we are on the same cpu
* during the cmpxchg then the free will succedd.
*/
+ preempt_disable();
c = __this_cpu_ptr(s->cpu_slab);
tid = c->tid;
- barrier();
+ preempt_enable();
if (likely(page == c->page)) {
set_freepointer(s, object, c->freelist);