From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932787AbcHERmY (ORCPT ); Fri, 5 Aug 2016 13:42:24 -0400 Received: from mail-wm0-f50.google.com ([74.125.82.50]:35807 "EHLO mail-wm0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756782AbcHERmP (ORCPT ); Fri, 5 Aug 2016 13:42:15 -0400 From: Roman Pen Cc: Roman Pen , Tejun Heo , linux-kernel@vger.kernel.org Subject: [PATCH 1/1] percpu-refcount: do not forget to rcu_barrier() just before freeing Date: Fri, 5 Aug 2016 19:41:31 +0200 Message-Id: <20160805174131.22043-2-roman.penyaev@profitbricks.com> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20160805174131.22043-1-roman.penyaev@profitbricks.com> References: <20160805174131.22043-1-roman.penyaev@profitbricks.com> To: unlisted-recipients:; (no To-header on input) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org percpu issues some RCU callbacks to synchronize its state, so before freeing we have to wait all those callbacks to finish. E.g. the following simple sequence on stack causes nasty crash: struct percpu_ref ref; percpu_ref_init(&ref, release, 0, GFP_KERNEL); percpu_ref_kill(&ref); percpu_ref_exit(&ref); Also this patch includes inition to NULL of confirm_switch callback. Without this inition you have to zero out a chunk of memory or kernel frightfully complains with WARN_ON_ONCE(ref->confirm_switch) at __percpu_ref_switch_to_atomic. Signed-off-by: Roman Pen Cc: Tejun Heo Cc: linux-kernel@vger.kernel.org --- lib/percpu-refcount.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c index 6111bcb..ddf934b 100644 --- a/lib/percpu-refcount.c +++ b/lib/percpu-refcount.c @@ -82,6 +82,7 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release, atomic_long_set(&ref->count, start_count); ref->release = release; + ref->confirm_switch = NULL; return 0; } EXPORT_SYMBOL_GPL(percpu_ref_init); @@ -101,6 +102,7 @@ void percpu_ref_exit(struct percpu_ref *ref) unsigned long __percpu *percpu_count = percpu_count_ptr(ref); if (percpu_count) { + rcu_barrier_sched(); free_percpu(percpu_count); ref->percpu_count_ptr = __PERCPU_REF_ATOMIC_DEAD; } -- 2.9.0