The patch titled
idr: make idr_remove_all() do removal -before- free_layer()
has been added to the -mm tree. Its filename is
idr-make-idr_remove_all-do-removal-before-free_layer.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: idr: make idr_remove_all() do removal -before- free_layer()
From: "Paul E. McKenney" <paulmck@xxxxxxxxxxxxxxxxxx>
Fix a problem in the IDR system, where an idr_remove_all() hands a data
element to call_rcu() (via free_layer()) before making that data element
inaccessible to new readers. This is very bad, and results in readers
still having a reference to this data element at the end of the grace
period.
Tests on large machines that concurrently map and unmap user-space memory
within the same multithreaded process result in crashes within about five
minutes. Applying this patch increases the kernel's longevity to the
three-to-eight-hour range.
There appear to be other similar problems in idr_get_empty_slot() and
sub_remove(), but I fixed the easy one in idr_remove_all() first. It is
therefore no surprise that failures still occur.
Located-by: Milton Miller II <miltonm@xxxxxxxxxxxxxx>
Tested-by: Milton Miller II <miltonm@xxxxxxxxxxxxxx>
Signed-off-by: Paul E. McKenney <paulmck@xxxxxxxxxxxxxxxxxx>
Cc: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
lib/idr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN lib/idr.c~idr-make-idr_remove_all-do-removal-before-free_layer lib/idr.c
--- a/lib/idr.c~idr-make-idr_remove_all-do-removal-before-free_layer
+++ a/lib/idr.c
@@ -449,6 +449,7 @@ void idr_remove_all(struct idr *idp)
n = idp->layers * IDR_BITS;
p = idp->top;
+ rcu_assign_pointer(idp->top, NULL);
max = 1 << n;
id = 0;
@@ -467,7 +468,6 @@ void idr_remove_all(struct idr *idp)
p = *--paa;
}
}
- rcu_assign_pointer(idp->top, NULL);
idp->layers = 0;
}
EXPORT_SYMBOL(idr_remove_all);
_
Patches currently in -mm which might be from paulmck@xxxxxxxxxxxxxxxxxx are
origin.patch
idr-make-idr_remove_all-do-removal-before-free_layer.patch
linux-next.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
