Subject: [merged] lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process.patch removed from -mm tree To: biao.wang@xxxxxxxxx,mingo@xxxxxxx,peterz@xxxxxxxxxxxxx,stable@xxxxxxxxxxxxxxx,yanmin_zhang@xxxxxxxxxxxxxxx,mm-commits@xxxxxxxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Wed, 22 May 2013 12:33:18 -0700 The patch titled Subject: lib/klist.c: del waiter from klist_remove_waiters before waking waiting process has been removed from the -mm tree. Its filename was lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: "wang, biao" <biao.wang@xxxxxxxxx> Subject: lib/klist.c: del waiter from klist_remove_waiters before waking waiting process There is a race between klist_remove() and klist_release(). klist_remove() uses a local var `waiter' stored on the stack. When klist_release() calls wake_up_process(waiter->process) to wake up the waiter, the waiter might run immediately and reuse the stack. Then, klist_release() calls list_del(&waiter->list) to change previous wait data and causes corruption in the waiting thread's stack area. Signed-off-by: wang, biao <biao.wang@xxxxxxxxx> Acked-by: Peter Zijlstra <peterz@xxxxxxxxxxxxx> Cc: "Zhang, Yanmin" <yanmin_zhang@xxxxxxxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- lib/klist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN lib/klist.c~lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process lib/klist.c --- a/lib/klist.c~lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process +++ a/lib/klist.c @@ -193,10 +193,10 @@ static void klist_release(struct kref *k if (waiter->node != n) continue; + list_del(&waiter->list); waiter->woken = 1; mb(); wake_up_process(waiter->process); - list_del(&waiter->list); } spin_unlock(&klist_remove_lock); knode_set_klist(n, NULL); _ Patches currently in -mm which might be from biao.wang@xxxxxxxxx are linux-next.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html