Re: [PATCH] kernel: fix data race in put_pid

From: Will Deacon
Date: Fri Sep 18 2015 - 05:28:29 EST


On Fri, Sep 18, 2015 at 10:06:46AM +0100, Dmitry Vyukov wrote:
> On Fri, Sep 18, 2015 at 10:51 AM, Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote:
> > As an alternative patch, could we not do:
> >
> > void put_pid(struct pid *pid)
> > {
> > struct pid_namespace *ns;
> >
> > if (!pid)
> > return;
> >
> > ns = pid->numbers[pid->level].ns;
> > if ((atomic_read(&pid->count) == 1) ||
> > atomic_dec_and_test(&pid->count)) {
> >
> > + smp_read_barrier_depends(); /* ctrl-dep */
> >
> > kmem_cache_free(ns->pid_cachep, pid);
> > put_pid_ns(ns);
> > }
> > }
> >
> > That would upgrade the atomic_read() path to a full READ_ONCE_CTRL(),
> > and thereby avoid any of the kmem_cache_free() stores from leaking out.
> > And its free, except on Alpha. Whereas the atomic_read_acquire() will
> > generate a full memory barrier on whole bunch of archs.
>
>
> What you propose makes sense.
>
> +Will, Paul
>
> Can we have something along the lines of:
>
> #define atomic_read_ctrl(v) READ_ONCE_CTRL(&(v)->counter)

Funnily enough, I had this exact same discussion off-list yesterday
afternoon, since I wrote some code relying on a ctrl dependency from
an atomic_read to an atomic_xchg_relaxed.

So I guess I'm for the addition, but at the same time, could we make
atomic_read and atomic_set generic too?

Will
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/