Commit 6ff2d39b authored by Manfred Spraul's avatar Manfred Spraul Committed by Linus Torvalds

lib/idr.c: fix rcu related race with idr_find

2nd part of the fixes needed for
http://bugzilla.kernel.org/show_bug.cgi?id=11796.

When the idr tree is either grown or shrunk, then the update to the number
of layers and the top pointer were not atomic.  This race caused crashes.

The attached patch fixes that by replicating the layers counter in each
layer, thus idr_find doesn't need idp->layers anymore.
Signed-off-by: default avatarManfred Spraul <manfred@colorfullife.com>
Cc: Clement Calmels <cboulte@gmail.com>
Cc: Nadia Derbey <Nadia.Derbey@bull.net>
Cc: Pierre Peiffer <peifferp@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 1d678f36
...@@ -52,13 +52,14 @@ struct idr_layer { ...@@ -52,13 +52,14 @@ struct idr_layer {
unsigned long bitmap; /* A zero bit means "space here" */ unsigned long bitmap; /* A zero bit means "space here" */
struct idr_layer *ary[1<<IDR_BITS]; struct idr_layer *ary[1<<IDR_BITS];
int count; /* When zero, we can release it */ int count; /* When zero, we can release it */
int layer; /* distance from leaf */
struct rcu_head rcu_head; struct rcu_head rcu_head;
}; };
struct idr { struct idr {
struct idr_layer *top; struct idr_layer *top;
struct idr_layer *id_free; struct idr_layer *id_free;
int layers; int layers; /* only valid without concurrent changes */
int id_free_cnt; int id_free_cnt;
spinlock_t lock; spinlock_t lock;
}; };
......
...@@ -185,6 +185,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa) ...@@ -185,6 +185,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
new = get_from_free_list(idp); new = get_from_free_list(idp);
if (!new) if (!new)
return -1; return -1;
new->layer = l-1;
rcu_assign_pointer(p->ary[m], new); rcu_assign_pointer(p->ary[m], new);
p->count++; p->count++;
} }
...@@ -210,6 +211,7 @@ static int idr_get_empty_slot(struct idr *idp, int starting_id, ...@@ -210,6 +211,7 @@ static int idr_get_empty_slot(struct idr *idp, int starting_id,
if (unlikely(!p)) { if (unlikely(!p)) {
if (!(p = get_from_free_list(idp))) if (!(p = get_from_free_list(idp)))
return -1; return -1;
p->layer = 0;
layers = 1; layers = 1;
} }
/* /*
...@@ -237,6 +239,7 @@ static int idr_get_empty_slot(struct idr *idp, int starting_id, ...@@ -237,6 +239,7 @@ static int idr_get_empty_slot(struct idr *idp, int starting_id,
} }
new->ary[0] = p; new->ary[0] = p;
new->count = 1; new->count = 1;
new->layer = layers-1;
if (p->bitmap == IDR_FULL) if (p->bitmap == IDR_FULL)
__set_bit(0, &new->bitmap); __set_bit(0, &new->bitmap);
p = new; p = new;
...@@ -493,17 +496,21 @@ void *idr_find(struct idr *idp, int id) ...@@ -493,17 +496,21 @@ void *idr_find(struct idr *idp, int id)
int n; int n;
struct idr_layer *p; struct idr_layer *p;
n = idp->layers * IDR_BITS;
p = rcu_dereference(idp->top); p = rcu_dereference(idp->top);
if (!p)
return NULL;
n = (p->layer+1) * IDR_BITS;
/* Mask off upper bits we don't use for the search. */ /* Mask off upper bits we don't use for the search. */
id &= MAX_ID_MASK; id &= MAX_ID_MASK;
if (id >= (1 << n)) if (id >= (1 << n))
return NULL; return NULL;
BUG_ON(n == 0);
while (n > 0 && p) { while (n > 0 && p) {
n -= IDR_BITS; n -= IDR_BITS;
BUG_ON(n != p->layer*IDR_BITS);
p = rcu_dereference(p->ary[(id >> n) & IDR_MASK]); p = rcu_dereference(p->ary[(id >> n) & IDR_MASK]);
} }
return((void *)p); return((void *)p);
...@@ -582,8 +589,11 @@ void *idr_replace(struct idr *idp, void *ptr, int id) ...@@ -582,8 +589,11 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
int n; int n;
struct idr_layer *p, *old_p; struct idr_layer *p, *old_p;
n = idp->layers * IDR_BITS;
p = idp->top; p = idp->top;
if (!p)
return ERR_PTR(-EINVAL);
n = (p->layer+1) * IDR_BITS;
id &= MAX_ID_MASK; id &= MAX_ID_MASK;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment