Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Dmitry Vyukov 2cf12f821c lib/llist.c: fix data race in llist_del_first ... llist_del_first reads entry->next, but it did not acquire visibility over the entry node. As the result it can get a stale value of entry->next (e.g. NULL or whatever garbage was there before the appending thread wrote correct value). And then commit that value as llist head with cmpxchg. That will corrupt llist. Note there is a control-dependency between read of head->first and read of entry->next, but it does not make the code correct. Kernel memory model unambiguously says: "A load-load control dependency requires a full read memory barrier". Use smp_load_acquire to acquire visibility over the entry node. The data race was found with KernelThreadSanitizer (KTSAN). Here is an example of KTSAN report: ThreadSanitizer: data-race in llist_del_first Read of size 1 by thread T389 (K2630, CPU0): [<ffffffff8156b8a9>] llist_del_first+0x39/0x70 lib/llist.c:74 [< inlined >] tty_buffer_alloc drivers/tty/tty_buffer.c:181 [<ffffffff81664af4>] __tty_buffer_request_room+0xb4/0x250 drivers/tty/tty_buffer.c:292 [<ffffffff81664e6c>] tty_insert_flip_string_fixed_flag+0x6c/0x150 drivers/tty/tty_buffer.c:337 [< inlined >] tty_insert_flip_string include/linux/tty_flip.h:35 [<ffffffff81667422>] pty_write+0x72/0xc0 drivers/tty/pty.c:110 [< inlined >] process_output_block drivers/tty/n_tty.c:611 [<ffffffff8165c016>] n_tty_write+0x346/0x7f0 drivers/tty/n_tty.c:2401 [< inlined >] do_tty_write drivers/tty/tty_io.c:1159 [<ffffffff816568df>] tty_write+0x21f/0x3f0 drivers/tty/tty_io.c:1245 [<ffffffff8125f00f>] __vfs_write+0x5f/0x1f0 fs/read_write.c:489 [<ffffffff8125ff8f>] vfs_write+0xef/0x280 fs/read_write.c:538 [< inlined >] SYSC_write fs/read_write.c:585 [<ffffffff81261390>] SyS_write+0x70/0xe0 fs/read_write.c:577 [<ffffffff81ee862e>] entry_SYSCALL_64_fastpath+0x12/0x71 arch/x86/entry/entry_64.S:186 Previous write of size 8 by thread T226 (K761, CPU0): [<ffffffff8156b832>] llist_add_batch+0x32/0x70 lib/llist.c:44 (discriminator 16) [< inlined >] llist_add include/linux/llist.h:180 [<ffffffff816649fc>] tty_buffer_free+0x6c/0xb0 drivers/tty/tty_buffer.c:221 [<ffffffff816651e7>] flush_to_ldisc+0x107/0x300 drivers/tty/tty_buffer.c:514 [<ffffffff810b20ee>] process_one_work+0x47e/0x930 kernel/workqueue.c:2036 [<ffffffff810b2650>] worker_thread+0xb0/0x900 kernel/workqueue.c:2170 [<ffffffff810bbe20>] kthread+0x150/0x170 kernel/kthread.c:209 [<ffffffff81ee8a1f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:526 Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: Huang Ying <ying.huang@intel.com> Cc: Konstantin Serebryany <kcc@google.com> Cc: Andrey Konovalov <andreyknvl@google.com> Cc: Alexander Potapenko <glider@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2015-11-06 17:50:42 -08:00
..
842	crypto: 842 - Add CRC and validation support	2015-10-14 22:23:17 +08:00
fonts
lz4	lz4: fix system halt at boot kernel on x86_64	2015-05-24 11:56:29 -07:00
lzo
mpi	lib/mpi: fix off by one in mpi_read_raw_from_sgl	2015-10-20 22:10:47 +08:00
raid6	md/raid6: delta syndrome for ARM NEON	2015-08-31 19:29:05 +02:00
reed_solomon
xz
zlib_deflate	zlib_deflate/deftree: remove bi_reverse()	2015-09-10 13:29:01 -07:00
zlib_inflate
.gitignore
argv_split.c
asn1_decoder.c	ASN.1: Handle 'ANY OPTIONAL' in grammar	2015-08-05 13:38:07 +01:00
assoc_array.c	assoc_array: Include rcupdate.h for call_rcu() definition	2015-01-07 16:08:41 +00:00
atomic64.c	atomic: Provide atomic_{or,xor,and}	2015-07-27 14:06:24 +02:00
atomic64_test.c	atomic: Add simple atomic_t tests	2015-07-27 14:06:24 +02:00
audit.c
bcd.c
bch.c
bitmap.c	lib/bitmap.c: bitmap_parselist can accept string with whitespaces on head or tail	2015-09-10 13:29:01 -07:00
bitrev.c	ARM: 8187/1: add CONFIG_HAVE_ARCH_BITREVERSE to support rbit instruction	2014-12-22 16:43:06 +00:00
bsearch.c
btree.c
bug.c	module: Sanitize RCU usage and locking	2015-05-28 11:31:52 +09:30
build_OID_registry
bust_spinlocks.c
check_signature.c
checksum.c	lib/checksum.c: fix build for generic csum_tcpudp_nofold	2015-01-29 11:57:38 -08:00
clz_ctz.c
clz_tab.c
cmdline.c
compat_audit.c
cordic.c
cpu-notifier-error-inject.c
cpu_rmap.c	sched/topology: Rename topology_thread_cpumask() to topology_sibling_cpumask()	2015-05-27 15:22:15 +02:00
cpumask.c	revert "cpumask: don't perform while loop in cpumask_next_and()"	2015-06-18 17:00:23 -10:00
crc-ccitt.c
crc-itu-t.c	lib: crc-itu-t.[ch] fix 0x0x prefix in integer constants	2015-05-26 15:26:43 +02:00
crc-t10dif.c	lib: introduce crc_t10dif_update()	2015-05-30 22:42:24 -07:00
crc7.c
crc8.c
crc16.c
crc32.c
crc32defs.h
ctype.c
debug_info.c	kbuild: include core debug info when DEBUG_INFO_REDUCED	2015-06-11 15:08:32 +02:00
debug_locks.c
debugobjects.c
dec_and_lock.c
decompress.c	lib/decompress: set the compressor name to NULL on error	2015-07-17 16:39:54 -07:00
decompress_bunzip2.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_inflate.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unlz4.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unlzma.c	lib/decompress_unlzma: Do a NULL check for pointer	2015-09-10 13:29:01 -07:00
decompress_unlzo.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unxz.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
devres.c	devres: fix a for loop bounds check	2015-10-05 04:49:54 +01:00
digsig.c	KEYS: Merge the type-specific data with the payload data	2015-10-21 15:18:36 +01:00
div64.c	lib: correct link to the original source for div64_u64	2015-03-06 23:19:27 +01:00
dma-debug.c	debugfs: Pass bool pointer to debugfs_create_bool()	2015-10-04 11:36:07 +01:00
dump_stack.c
dynamic_debug.c	lib/dynamic_debug.c: use kstrdup_const	2015-11-06 17:50:42 -08:00
dynamic_queue_limits.c	lib/dynamic_queue_limits.c: simplify includes	2015-02-12 18:54:15 -08:00
earlycpio.c
extable.c
fault-inject.c	fault-inject: fix inverted interval/probability values in printk	2015-10-23 17:55:10 +09:00
fdt.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_bit.c	lib: rename lib/find_next_bit.c to lib/find_bit.c	2015-04-17 09:03:54 -04:00
flex_array.c
flex_proportions.c
gcd.c
gen_crc32table.c	lib: crc32: constify crc32 lookup table	2015-02-13 21:21:35 -08:00
genalloc.c	genalloc: add support of multiple gen_pools per device	2015-09-04 16:54:41 -07:00
glob.c
halfmd4.c	lib/halfmd4.c: use rol32 inline function in the ROUND macro	2015-11-06 17:50:42 -08:00
hexdump.c	hexdump: fix for non-aligned buffers	2015-07-17 16:39:53 -07:00
hweight.c
idr.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
inflate.c
int_sqrt.c
interval_tree.c	lib/interval_tree.c: simplify includes	2015-02-12 18:54:15 -08:00
interval_tree_test.c
iomap.c
iomap_copy.c
iommu-common.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc	2015-11-05 16:34:48 -08:00
iommu-helper.c
ioremap.c	x86, mm: support huge KVA mappings on x86	2015-04-14 16:49:04 -07:00
iov_iter.c	Merge branch 'iov_iter' into for-next	2015-04-11 22:26:51 -04:00
irq_regs.c
is_single_threaded.c
jedec_ddr_data.c
kasprintf.c
Kconfig	lib/Kconfig: ZLIB_DEFLATE must select BITREVERSE	2015-10-16 11:42:28 -07:00
Kconfig.debug	test_printf: test printf family at runtime	2015-11-06 17:50:42 -08:00
Kconfig.kasan	mm, slub, kasan: enable user tracking by default with KASAN=y	2015-11-05 19:34:48 -08:00
Kconfig.kgdb
Kconfig.kmemcheck
kfifo.c
klist.c	klist: implement klist_prev()	2015-07-28 08:50:42 +01:00
kobject.c	kobject: move EXPORT_SYMBOL() macros next to corresponding definitions	2015-10-04 11:46:16 +01:00
kobject_uevent.c	lib/kobject_uevent.c: remove redundant include	2015-02-12 18:54:15 -08:00
kstrtox.c	kstrto*: accept "-0" for signed conversion	2015-09-10 13:29:01 -07:00
kstrtox.h
lcm.c	block: fix blk_stack_limits() regression due to lcm() change	2015-03-31 09:45:50 -06:00
libcrc32c.c
list_debug.c
list_sort.c	lib/list_sort: use late_initcall to hook in self tests	2015-06-16 14:12:35 -04:00
llist.c	lib/llist.c: fix data race in llist_del_first	2015-11-06 17:50:42 -08:00
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lockref.c	locking/lockref: Remove homebrew cmpxchg64_relaxed() macro definition	2015-08-12 11:59:04 +02:00
lru_cache.c	lru_cache: remove use of seq_printf return value	2015-04-15 16:35:25 -07:00
Makefile	test_printf: test printf family at runtime	2015-11-06 17:50:42 -08:00
md5.c	lib/md5.c: simplify include	2015-02-12 18:54:15 -08:00
memory-notifier-error-inject.c
memweight.c
net_utils.c
nlattr.c	netlink: pad nla_memcpy dest buffer with zeroes	2015-03-31 14:07:24 -04:00
nmi_backtrace.c	ARM: 8439/1: Fix backtrace generation when IPI is masked	2015-10-03 16:40:51 +01:00
notifier-error-inject.c
notifier-error-inject.h
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c	once: make helper generic for calling functions once	2015-10-08 05:26:36 -07:00
parser.c
pci_iomap.c	libnvdimm for 4.3:	2015-09-08 14:35:59 -07:00
percpu-refcount.c
percpu_counter.c	percpu_counter: batch size aware __percpu_counter_compare()	2015-05-29 07:39:34 +10:00
percpu_ida.c	mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM	2015-11-06 17:50:42 -08:00
percpu_test.c
plist.c	lib/plist.c: remove redundant include	2015-02-12 18:54:16 -08:00
pm-notifier-error-inject.c
proportions.c
radix-tree.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
random32.c	random32: add prandom_init_once helper for own rngs	2015-10-08 05:26:38 -07:00
ratelimit.c
rational.c
rbtree.c	rbtree: Make lockless searches non-fatal	2015-05-28 11:32:04 +09:30
rbtree_test.c
reciprocal_div.c
rhashtable.c	lib: fix data race in rhashtable_rehash_one	2015-09-22 17:36:07 -07:00
scatterlist.c	scatterlist: allow limited chaining without ARCH_HAS_SG_CHAIN	2015-08-17 08:12:51 -06:00
seq_buf.c	seq_buf: Fix seq_buf_bprintf() truncation	2015-03-04 23:40:19 -05:00
sg_split.c	lib: scatterlist: add sg splitting function	2015-08-24 14:28:01 -06:00
sha1.c	lib: EXPORT_SYMBOL sha_init	2015-03-23 22:12:08 -04:00
show_mem.c	lib/show_mem.c: correct reserved memory calculation	2015-09-08 15:35:28 -07:00
smp_processor_id.c
sort.c	lib/sort: Add 64 bit swap function	2015-06-25 17:00:40 -07:00
stmp_device.c	lib/stmp_device.c: replace module.h include	2015-02-12 18:54:16 -08:00
string.c	strscpy: zero any trailing garbage bytes in the destination	2015-10-06 14:53:18 -04:00
string_helpers.c	lib/string_helpers.c: fix infinite loop in string_get_size()	2015-09-17 21:16:07 -07:00
strncpy_from_user.c	lib: move strncpy_from_unsafe() into mm/maccess.c	2015-08-31 12:36:10 -07:00
strnlen_user.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-06-22 15:52:04 -07:00
swiotlb.c	Merge branch 'for-4.2/sg' of git://git.kernel.dk/linux-block	2015-06-25 15:22:36 -07:00
syscall.c
test-hexdump.c	hexdump: Make test data really const	2015-06-25 17:00:40 -07:00
test-kstrtox.c	kstrto*: accept "-0" for signed conversion	2015-09-10 13:29:01 -07:00
test-string_helpers.c	lib/test-string_helpers.c: add string_get_size() tests	2015-11-06 17:50:42 -08:00
test_bpf.c	test_bpf: add tests checking that JIT/interpreter sets A and X to 0.	2015-08-06 22:02:32 -07:00
test_firmware.c
test_kasan.c	lib: test_kasan: add some testcases	2015-11-05 19:34:48 -08:00
test_module.c
test_printf.c	test_printf: test printf family at runtime	2015-11-06 17:50:42 -08:00
test_rhashtable.c	rhashtable-test: extend to test concurrency	2015-08-17 14:33:47 -07:00
test_static_key_base.c	locking/static_keys: Provide a selftest	2015-08-03 11:51:12 +02:00
test_static_keys.c	locking/static_keys: Make verify_keys() static	2015-08-05 09:53:40 +02:00
test_user_copy.c
textsearch.c
timerqueue.c	timerqueue: Let timerqueue_add/del return information	2015-04-22 17:06:49 +02:00
ts_bm.c
ts_fsm.c
ts_kmp.c
ucs2_string.c
usercopy.c
uuid.c
vsprintf.c	lib/vsprintf.c: update documentation	2015-11-06 17:50:42 -08:00