Subject: [merged] lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process.patch removed from -mm tree
To: biao.wang@xxxxxxxxx,mingo@xxxxxxx,peterz@xxxxxxxxxxxxx,stable@xxxxxxxxxxxxxxx,yanmin_zhang@xxxxxxxxxxxxxxx,mm-commits@xxxxxxxxxxxxxxx
From: akpm@xxxxxxxxxxxxxxxxxxxx
Date: Wed, 22 May 2013 12:33:18 -0700
The patch titled
Subject: lib/klist.c: del waiter from klist_remove_waiters before waking waiting process
has been removed from the -mm tree. Its filename was
lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: "wang, biao" <biao.wang@xxxxxxxxx>
Subject: lib/klist.c: del waiter from klist_remove_waiters before waking waiting process
There is a race between klist_remove() and klist_release().
klist_remove() uses a local var `waiter' stored on the stack. When
klist_release() calls wake_up_process(waiter->process) to wake up the
waiter, the waiter might run immediately and reuse the stack. Then,
klist_release() calls list_del(&waiter->list) to change previous wait data
and causes corruption in the waiting thread's stack area.
Signed-off-by: wang, biao <biao.wang@xxxxxxxxx>
Acked-by: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: "Zhang, Yanmin" <yanmin_zhang@xxxxxxxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
lib/klist.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN lib/klist.c~lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process lib/klist.c
--- a/lib/klist.c~lib-klistc-del-waiter-from-klist_remove_waiters-before-waking-waiting-process
+++ a/lib/klist.c
@@ -193,10 +193,10 @@ static void klist_release(struct kref *k
if (waiter->node != n)
continue;
+ list_del(&waiter->list);
waiter->woken = 1;
mb();
wake_up_process(waiter->process);
- list_del(&waiter->list);
}
spin_unlock(&klist_remove_lock);
knode_set_klist(n, NULL);
_
Patches currently in -mm which might be from biao.wang@xxxxxxxxx are
linux-next.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html