mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-28 20:02:17 +00:00
locking/rwsem: Fix down_write_killable()
The new signal_pending exit path in __rwsem_down_write_failed_common() was fingered as breaking his kernel by Tetsuo Handa. Upon inspection it was found that there are two things wrong with it; - it forgets to remove WAITING_BIAS if it leaves the list empty, or - it forgets to wake further waiters that were blocked on the now removed waiter. Especially the first issue causes new lock attempts to block and stall indefinitely, as the code assumes that pending waiters mean there is an owner that will wake when it releases the lock. Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: Michal Hocko <mhocko@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Chris Zankel <chris@zankel.net> Cc: David S. Miller <davem@davemloft.net> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Max Filippov <jcmvbkbc@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Tony Luck <tony.luck@intel.com> Cc: Vince Weaver <vincent.weaver@maine.edu> Cc: Waiman Long <Waiman.Long@hpe.com> Link: http://lkml.kernel.org/r/20160512115745.GP3192@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
parent
00fb16e26a
commit
04cafed7fc
1 changed files with 15 additions and 6 deletions
|
@ -487,23 +487,32 @@ __rwsem_down_write_failed_common(struct rw_semaphore *sem, int state)
|
||||||
|
|
||||||
/* Block until there are no active lockers. */
|
/* Block until there are no active lockers. */
|
||||||
do {
|
do {
|
||||||
if (signal_pending_state(state, current)) {
|
if (signal_pending_state(state, current))
|
||||||
raw_spin_lock_irq(&sem->wait_lock);
|
goto out_nolock;
|
||||||
ret = ERR_PTR(-EINTR);
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
schedule();
|
schedule();
|
||||||
set_current_state(state);
|
set_current_state(state);
|
||||||
} while ((count = sem->count) & RWSEM_ACTIVE_MASK);
|
} while ((count = sem->count) & RWSEM_ACTIVE_MASK);
|
||||||
|
|
||||||
raw_spin_lock_irq(&sem->wait_lock);
|
raw_spin_lock_irq(&sem->wait_lock);
|
||||||
}
|
}
|
||||||
out:
|
|
||||||
__set_current_state(TASK_RUNNING);
|
__set_current_state(TASK_RUNNING);
|
||||||
list_del(&waiter.list);
|
list_del(&waiter.list);
|
||||||
raw_spin_unlock_irq(&sem->wait_lock);
|
raw_spin_unlock_irq(&sem->wait_lock);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
|
out_nolock:
|
||||||
|
__set_current_state(TASK_RUNNING);
|
||||||
|
raw_spin_lock_irq(&sem->wait_lock);
|
||||||
|
list_del(&waiter.list);
|
||||||
|
if (list_empty(&sem->wait_list))
|
||||||
|
rwsem_atomic_update(-RWSEM_WAITING_BIAS, sem);
|
||||||
|
else
|
||||||
|
__rwsem_do_wake(sem, RWSEM_WAKE_ANY);
|
||||||
|
raw_spin_unlock_irq(&sem->wait_lock);
|
||||||
|
|
||||||
|
return ERR_PTR(-EINTR);
|
||||||
}
|
}
|
||||||
|
|
||||||
__visible struct rw_semaphore * __sched
|
__visible struct rw_semaphore * __sched
|
||||||
|
|
Loading…
Reference in a new issue