| From c34ac00caefbe49d40058ae7200bd58725cebb45 Mon Sep 17 00:00:00 2001 |
| From: Tejun Heo <tj@kernel.org> |
| Date: Fri, 28 Jun 2013 10:34:48 -0700 |
| Subject: rculist: list_first_or_null_rcu() should use list_entry_rcu() |
| |
| From: Tejun Heo <tj@kernel.org> |
| |
| commit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream. |
| |
| list_first_or_null() should test whether the list is empty and return |
| pointer to the first entry if not in a RCU safe manner. It's broken |
| in several ways. |
| |
| * It compares __kernel @__ptr with __rcu @__next triggering the |
| following sparse warning. |
| |
| net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces) |
| |
| * It doesn't perform rcu_dereference*() and computes the entry address |
| using container_of() directly from the __rcu pointer which is |
| inconsitent with other rculist interface. As a result, all three |
| in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They |
| dereference the pointer w/o going through read barrier. |
| |
| * While ->next dereference passes through list_next_rcu(), the |
| compiler is still free to fetch ->next more than once and thus |
| nullify the "__ptr != __next" condition check. |
| |
| Fix it by making list_first_or_null_rcu() dereference ->next directly |
| using ACCESS_ONCE() and then use list_entry_rcu() on it like other |
| rculist accessors. |
| |
| v2: Paul pointed out that the compiler may fetch the pointer more than |
| once nullifying the condition check. ACCESS_ONCE() added on |
| ->next dereference. |
| |
| v3: Restored () around macro param which was accidentally removed. |
| Spotted by Paul. |
| |
| Signed-off-by: Tejun Heo <tj@kernel.org> |
| Reported-by: Fengguang Wu <fengguang.wu@intel.com> |
| Cc: Dipankar Sarma <dipankar@in.ibm.com> |
| Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com> |
| Cc: "David S. Miller" <davem@davemloft.net> |
| Cc: Li Zefan <lizefan@huawei.com> |
| Cc: Patrick McHardy <kaber@trash.net> |
| Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> |
| Reviewed-by: Josh Triplett <josh@joshtriplett.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| include/linux/rculist.h | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| --- a/include/linux/rculist.h |
| +++ b/include/linux/rculist.h |
| @@ -254,8 +254,9 @@ static inline void list_splice_init_rcu( |
| */ |
| #define list_first_or_null_rcu(ptr, type, member) \ |
| ({struct list_head *__ptr = (ptr); \ |
| - struct list_head __rcu *__next = list_next_rcu(__ptr); \ |
| - likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \ |
| + struct list_head *__next = ACCESS_ONCE(__ptr->next); \ |
| + likely(__ptr != __next) ? \ |
| + list_entry_rcu(__next, type, member) : NULL; \ |
| }) |
| |
| /** |