Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c87a124a authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: force a reload of first item in hlist_nulls_for_each_entry_rcu 

Roman Gushchin discovered that udp4_lib_lookup2() was not reloading
first item in the rcu protected list, in case the loop was restarted.

This produced soft lockups as in https://lkml.org/lkml/2013/4/16/37



rcu_dereference(X)/ACCESS_ONCE(X) seem to not work as intended if X is
ptr->field :

In some cases, gcc caches the value or ptr->field in a register.

Use a barrier() to disallow such caching, as documented in
Documentation/atomic_ops.txt line 114

Thanks a lot to Roman for providing analysis and numerous patches.

Diagnosed-by: default avatarRoman Gushchin <klamm@yandex-team.ru>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarBoris Zhmurov <zhmurov@yandex-team.ru>
Signed-off-by: default avatarRoman Gushchin <klamm@yandex-team.ru>
Acked-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c802db11

include/linux/rculist_nulls.h

+6 −1
Original line number Original line Diff line number Diff line
@@ -105,9 +105,14 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n, 
 * @head:	the head for your list.

 * @head:	the head for your list.

 * @member:	the name of the hlist_nulls_node within the struct.

 * @member:	the name of the hlist_nulls_node within the struct.

 *

 *

 * The barrier() is needed to make sure compiler doesn't cache first element [1],

 * as this loop can be restarted [2]

 * [1] Documentation/atomic_ops.txt around line 114

 * [2] Documentation/RCU/rculist_nulls.txt around line 146

 */

 */

#define hlist_nulls_for_each_entry_rcu(tpos, pos, head, member)			\

#define hlist_nulls_for_each_entry_rcu(tpos, pos, head, member)			\

	for (pos = rcu_dereference_raw(hlist_nulls_first_rcu(head));		\

	for (({barrier();}),							\

	     pos = rcu_dereference_raw(hlist_nulls_first_rcu(head));		\

		(!is_a_nulls(pos)) &&						\

		(!is_a_nulls(pos)) &&						\

		({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member); 1; }); \

		({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member); 1; }); \

		pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)))

		pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)))