[GIT PULL] percpu fixes for v3.18-rc5

[Tejun Heo <tj@kernel.org>]

Hello, Linus.

This pull request contains one patch to fix a race condition which can
lead to percpu_ref using a percpu pointer which is corrupted with a
set DEAD bit.  The bug was introduced while separating out the ATOMIC
mode flag from the DEAD flag.  The fix is pretty straight forward.

I just committed the patch to the percpu tree but am sending out the
pull request early as I'll be on vacation for a week.  The patch
should be fairly safe and while the latency will be higher I'll be
checking emails.

Thanks.

The following changes since commit cac7f2429872d3733dc3f9915857b1691da2eb2f:

  Linux 3.18-rc2 (2014-10-26 16:48:41 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu.git for-3.18-fixes

for you to fetch changes up to 4aab3b5b3ccf94fc907e66233e6ca4d8675759a6:

  percpu-ref: fix DEAD flag contamination of percpu pointer (2014-11-23 12:36:06 -0500)

----------------------------------------------------------------
Tejun Heo (1):
      percpu-ref: fix DEAD flag contamination of percpu pointer

 include/linux/percpu-refcount.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index d5c89e0..51ce60c 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -133,7 +133,13 @@ static inline bool __ref_is_percpu(struct percpu_ref *ref,
 	/* paired with smp_store_release() in percpu_ref_reinit() */
 	smp_read_barrier_depends();
 
-	if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC))
+	/*
+	 * Theoretically, the following could test just ATOMIC; however,
+	 * then we'd have to mask off DEAD separately as DEAD may be
+	 * visible without ATOMIC if we race with percpu_ref_kill().  DEAD
+	 * implies ATOMIC anyway.  Test them together.
+	 */
+	if (unlikely(percpu_ptr & __PERCPU_REF_ATOMIC_DEAD))
 		return false;
 
 	*percpu_countp = (unsigned long __percpu *)percpu_ptr;