* 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection!
@ 2010-07-07 0:25 Miles Lane
2010-07-07 4:34 ` Eric Dumazet
0 siblings, 1 reply; 3+ messages in thread
From: Miles Lane @ 2010-07-07 0:25 UTC (permalink / raw)
To: Paul E. McKenney, LKML
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection!
other info that might help us debug this:
rcu_scheduler_active = 1, debug_locks = 1
no locks held by compiz/4286.
stack backtrace:
Pid: 4286, comm: compiz Not tainted 2.6.35-rc4 #6
Call Trace:
[<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
[<ffffffff810d3bdd>] fcheck_files+0x5c/0xca
[<ffffffff810d3ca3>] fget_light+0x35/0x96
[<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
[<ffffffff810e1316>] ? __pollwait+0x0/0xc7
[<ffffffff810e13dd>] ? pollwake+0x0/0x4f
[<ffffffff8125b785>] ? __sock_sendmsg+0x66/0x72
[<ffffffff8125da9e>] ? sock_aio_write+0x0/0xf6
[<ffffffff8125db7f>] ? sock_aio_write+0xe1/0xf6
[<ffffffff810d295f>] ? do_sync_readv_writev+0xbc/0xfb
[<ffffffff810d284f>] ? fsnotify_modify+0x67/0x6f
[<ffffffff810d35eb>] ? do_readv_writev+0x109/0x122
[<ffffffff81009cba>] ? sysret_check+0x2e/0x69
[<ffffffff810e1e7c>] sys_poll+0x50/0xba
[<ffffffff81009c82>] system_call_fastpath+0x16/0x1b
===============================================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
include/linux/fdtable.h:88 invoked rcu_dereference_check() without protection!
other info that might help us debug this:
rcu_scheduler_active = 1, debug_locks = 1
no locks held by gnome-panel/4293.
stack backtrace:
Pid: 4293, comm: gnome-panel Not tainted 2.6.35-rc4 #6
Call Trace:
[<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
[<ffffffff810d3c32>] fcheck_files+0xb1/0xca
[<ffffffff810ab263>] ? might_fault+0x63/0xb3
[<ffffffff810d3ca3>] fget_light+0x35/0x96
[<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
[<ffffffff810e1316>] ? __pollwait+0x0/0xc7
[<ffffffff8125a2ae>] ? __sock_recvmsg_nosec+0x65/0x6e
[<ffffffff8125b7da>] ? __sock_recvmsg+0x49/0x54
[<ffffffff8125da8a>] ? sock_aio_read+0xe8/0xfc
[<ffffffff810d2b67>] ? do_sync_read+0xc6/0x103
[<ffffffff81009cba>] ? sysret_check+0x2e/0x69
[<ffffffff810e1e7c>] sys_poll+0x50/0xba
[<ffffffff81009c82>] system_call_fastpath+0x16/0x1b
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection!
2010-07-07 0:25 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection! Miles Lane
@ 2010-07-07 4:34 ` Eric Dumazet
2010-07-07 4:37 ` Eric Dumazet
0 siblings, 1 reply; 3+ messages in thread
From: Eric Dumazet @ 2010-07-07 4:34 UTC (permalink / raw)
To: Miles Lane; +Cc: Paul E. McKenney, LKML
Le mardi 06 juillet 2010 à 20:25 -0400, Miles Lane a écrit :
> [ INFO: suspicious rcu_dereference_check() usage. ]
> ---------------------------------------------------
> include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection!
>
> other info that might help us debug this:
>
> rcu_scheduler_active = 1, debug_locks = 1
> no locks held by compiz/4286.
>
> stack backtrace:
> Pid: 4286, comm: compiz Not tainted 2.6.35-rc4 #6
> Call Trace:
> [<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
> [<ffffffff810d3bdd>] fcheck_files+0x5c/0xca
> [<ffffffff810d3ca3>] fget_light+0x35/0x96
> [<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
> [<ffffffff810e1316>] ? __pollwait+0x0/0xc7
> [<ffffffff810e13dd>] ? pollwake+0x0/0x4f
> [<ffffffff8125b785>] ? __sock_sendmsg+0x66/0x72
> [<ffffffff8125da9e>] ? sock_aio_write+0x0/0xf6
> [<ffffffff8125db7f>] ? sock_aio_write+0xe1/0xf6
> [<ffffffff810d295f>] ? do_sync_readv_writev+0xbc/0xfb
> [<ffffffff810d284f>] ? fsnotify_modify+0x67/0x6f
> [<ffffffff810d35eb>] ? do_readv_writev+0x109/0x122
> [<ffffffff81009cba>] ? sysret_check+0x2e/0x69
> [<ffffffff810e1e7c>] sys_poll+0x50/0xba
> [<ffffffff81009c82>] system_call_fastpath+0x16/0x1b
>
> ===============================================================================
>
> [ INFO: suspicious rcu_dereference_check() usage. ]
> ---------------------------------------------------
> include/linux/fdtable.h:88 invoked rcu_dereference_check() without protection!
>
> other info that might help us debug this:
>
> rcu_scheduler_active = 1, debug_locks = 1
> no locks held by gnome-panel/4293.
>
> stack backtrace:
> Pid: 4293, comm: gnome-panel Not tainted 2.6.35-rc4 #6
> Call Trace:
> [<ffffffff8106714e>] lockdep_rcu_dereference+0x9d/0xa6
> [<ffffffff810d3c32>] fcheck_files+0xb1/0xca
> [<ffffffff810ab263>] ? might_fault+0x63/0xb3
> [<ffffffff810d3ca3>] fget_light+0x35/0x96
> [<ffffffff810e1b02>] do_sys_poll+0x1ff/0x3e5
> [<ffffffff810e1316>] ? __pollwait+0x0/0xc7
> [<ffffffff8125a2ae>] ? __sock_recvmsg_nosec+0x65/0x6e
> [<ffffffff8125b7da>] ? __sock_recvmsg+0x49/0x54
> [<ffffffff8125da8a>] ? sock_aio_read+0xe8/0xfc
> [<ffffffff810d2b67>] ? do_sync_read+0xc6/0x103
> [<ffffffff81009cba>] ? sysret_check+0x2e/0x69
> [<ffffffff810e1e7c>] sys_poll+0x50/0xba
> [<ffffffff81009c82>] system_call_fastpath+0x16/0x1b
> --
Miles, you already posted this three times, and a fix is known.
BTW, I dont know why it's not already in, Paul submitted it several
times, but nobody cares.
http://kerneltrap.org/mailarchive/linux-kernel/2010/6/17/4584014
I am going to Ack it, maybe some other guys can help to.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection!
2010-07-07 4:34 ` Eric Dumazet
@ 2010-07-07 4:37 ` Eric Dumazet
0 siblings, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2010-07-07 4:37 UTC (permalink / raw)
To: Miles Lane; +Cc: Paul E. McKenney, LKML
Le mercredi 07 juillet 2010 à 06:34 +0200, Eric Dumazet a écrit :
> Miles, you already posted this three times, and a fix is known.
>
> BTW, I dont know why it's not already in, Paul submitted it several
> times, but nobody cares.
>
> http://kerneltrap.org/mailarchive/linux-kernel/2010/6/17/4584014
>
> I am going to Ack it, maybe some other guys can help to.
>
Ah, its in Andrew tree since 6 days, it should be sent to Linus promptly
now...
The patch titled
vfs: fix RCU-lockdep false positive due to /proc
has been added to the -mm tree. Its filename is
vfs-fix-rcu-lockdep-false-positive-due-to-proc.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code
***
See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this
The current -mm tree may be found at
http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: vfs: fix RCU-lockdep false positive due to /proc
From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
If a single-threaded process does a file-descriptor operation, and some
other process accesses that same file descriptor via /proc, the current
rcu_dereference_check_fdtable() can give a false-positive RCU-lockdep
splat due to the reference count being increased by the /proc access
after
the reference-count check in fget_light() but before the check in
rcu_dereference_check_fdtable().
This commit prevents this false positive by checking for a
single-threaded
process. To avoid #include hell, this commit uses the wrapper for
thread_group_empty(current) defined by rcu_my_thread_group_empty()
provided in a separate commit.
Located-by: Miles Lane <miles.lane@gmail.com>
Located-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
include/linux/fdtable.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff -puN
include/linux/fdtable.h~vfs-fix-rcu-lockdep-false-positive-due-to-proc
include/linux/fdtable.h
---
a/include/linux/fdtable.h~vfs-fix-rcu-lockdep-false-positive-due-to-proc
+++ a/include/linux/fdtable.h
@@ -62,7 +62,8 @@ struct files_struct {
(rcu_dereference_check((fdtfd), \
rcu_read_lock_held() || \
lockdep_is_held(&(files)->file_lock) || \
- atomic_read(&(files)->count) == 1))
+ atomic_read(&(files)->count) == 1 || \
+ rcu_my_thread_group_empty()))
#define files_fdtable(files) \
(rcu_dereference_check_fdtable((files), (files)->fdt))
_
Patches currently in -mm which might be from
paulmck@linux.vnet.ibm.com are
origin.patch
fs-fcntlc-kill_fasync_rcu-fa_lock-must-be-irq-safe.patch
linux-next.patch
vfs-fix-rcu-lockdep-false-positive-due-to-proc.patch
vfs-use-kmalloc-to-allocate-fdmem-if-possible.patch
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-07-07 4:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-07-07 0:25 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference_check() without protection! Miles Lane
2010-07-07 4:34 ` Eric Dumazet
2010-07-07 4:37 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®