]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
ptr_ring: fix race conditions when resizing
authorMichael S. Tsirkin <mst@redhat.com>
Sun, 19 Feb 2017 05:17:17 +0000 (07:17 +0200)
committerTim Gardner <tim.gardner@canonical.com>
Wed, 1 Mar 2017 14:13:35 +0000 (07:13 -0700)
commitdb2884af435d39409d48c39e4305d247e68176cc
treee7f4acb6dfa6fef9dabb3f50e9cfd9a2fd60b2e9
parent769a2324fc5f33f5bd686f943ddf0078fffecb7a
ptr_ring: fix race conditions when resizing

BugLink: http://bugs.launchpad.net/bugs/1668993
[ Upstream commit e71695307114335be1ed912f4a347396c2ed0e69 ]

Resizing currently drops consumer lock.  This can cause entries to be
reordered, which isn't good in itself.  More importantly, consumer can
detect a false ring empty condition and block forever.

Further, nesting of consumer within producer lock is problematic for
tun, since it produces entries in a BH, which causes a lock order
reversal:

       CPU0                    CPU1
       ----                    ----
  consume:
  lock(&(&r->consumer_lock)->rlock);
                               resize:
                               local_irq_disable();
                               lock(&(&r->producer_lock)->rlock);
                               lock(&(&r->consumer_lock)->rlock);
  <Interrupt>
  produce:
  lock(&(&r->producer_lock)->rlock);

To fix, nest producer lock within consumer lock during resize,
and keep consumer lock during the whole swap operation.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: stable@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
include/linux/ptr_ring.h