 d69b78ba1d
			
		
	
	
	d69b78ba1d
	
	
	
		
			
			Using: - CONFIG_LOCKUP_DETECTOR=y - CONFIG_PREEMPT=y - CONFIG_LOCKDEP=y - CONFIG_PROVE_LOCKING=y - CONFIG_PROVE_RCU=y found a missing rcu lock during boot on a 512 MiB x86_64 ubuntu vm: =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- kernel/pid.c:419 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 1 lock held by ureadahead/1355: #0: (tasklist_lock){.+.+..}, at: [<ffffffff8115bc09>] sys_ioprio_set+0x7f/0x29e stack backtrace: Pid: 1355, comm: ureadahead Not tainted 2.6.37-dbg-DEV #1 Call Trace: [<ffffffff8109c10c>] lockdep_rcu_dereference+0xaa/0xb3 [<ffffffff81088cbf>] find_task_by_pid_ns+0x44/0x5d [<ffffffff81088cfa>] find_task_by_vpid+0x22/0x24 [<ffffffff8115bc3e>] sys_ioprio_set+0xb4/0x29e [<ffffffff8147cf21>] ? trace_hardirqs_off_thunk+0x3a/0x3c [<ffffffff8105c409>] sysenter_dispatch+0x7/0x2c [<ffffffff8147cee2>] ? trace_hardirqs_on_thunk+0x3a/0x3f The fix is to: a) grab rcu lock in sys_ioprio_{set,get}() and b) avoid grabbing tasklist_lock. Discussion in: http://marc.info/?l=linux-kernel&m=128951324702889 Signed-off-by: Greg Thelen <gthelen@google.com> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Modified by Jens to remove the now redundant inner rcu lock and unlock since they are now protected by the outer lock. Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
		
			
				
	
	
		
			250 lines
		
	
	
	
		
			5 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			250 lines
		
	
	
	
		
			5 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  * fs/ioprio.c
 | |
|  *
 | |
|  * Copyright (C) 2004 Jens Axboe <axboe@kernel.dk>
 | |
|  *
 | |
|  * Helper functions for setting/querying io priorities of processes. The
 | |
|  * system calls closely mimmick getpriority/setpriority, see the man page for
 | |
|  * those. The prio argument is a composite of prio class and prio data, where
 | |
|  * the data argument has meaning within that class. The standard scheduling
 | |
|  * classes have 8 distinct prio levels, with 0 being the highest prio and 7
 | |
|  * being the lowest.
 | |
|  *
 | |
|  * IOW, setting BE scheduling class with prio 2 is done ala:
 | |
|  *
 | |
|  * unsigned int prio = (IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) | 2;
 | |
|  *
 | |
|  * ioprio_set(PRIO_PROCESS, pid, prio);
 | |
|  *
 | |
|  * See also Documentation/block/ioprio.txt
 | |
|  *
 | |
|  */
 | |
| #include <linux/gfp.h>
 | |
| #include <linux/kernel.h>
 | |
| #include <linux/ioprio.h>
 | |
| #include <linux/blkdev.h>
 | |
| #include <linux/capability.h>
 | |
| #include <linux/syscalls.h>
 | |
| #include <linux/security.h>
 | |
| #include <linux/pid_namespace.h>
 | |
| 
 | |
| int set_task_ioprio(struct task_struct *task, int ioprio)
 | |
| {
 | |
| 	int err;
 | |
| 	struct io_context *ioc;
 | |
| 	const struct cred *cred = current_cred(), *tcred;
 | |
| 
 | |
| 	rcu_read_lock();
 | |
| 	tcred = __task_cred(task);
 | |
| 	if (tcred->uid != cred->euid &&
 | |
| 	    tcred->uid != cred->uid && !capable(CAP_SYS_NICE)) {
 | |
| 		rcu_read_unlock();
 | |
| 		return -EPERM;
 | |
| 	}
 | |
| 	rcu_read_unlock();
 | |
| 
 | |
| 	err = security_task_setioprio(task, ioprio);
 | |
| 	if (err)
 | |
| 		return err;
 | |
| 
 | |
| 	task_lock(task);
 | |
| 	do {
 | |
| 		ioc = task->io_context;
 | |
| 		/* see wmb() in current_io_context() */
 | |
| 		smp_read_barrier_depends();
 | |
| 		if (ioc)
 | |
| 			break;
 | |
| 
 | |
| 		ioc = alloc_io_context(GFP_ATOMIC, -1);
 | |
| 		if (!ioc) {
 | |
| 			err = -ENOMEM;
 | |
| 			break;
 | |
| 		}
 | |
| 		task->io_context = ioc;
 | |
| 	} while (1);
 | |
| 
 | |
| 	if (!err) {
 | |
| 		ioc->ioprio = ioprio;
 | |
| 		ioc->ioprio_changed = 1;
 | |
| 	}
 | |
| 
 | |
| 	task_unlock(task);
 | |
| 	return err;
 | |
| }
 | |
| EXPORT_SYMBOL_GPL(set_task_ioprio);
 | |
| 
 | |
| SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio)
 | |
| {
 | |
| 	int class = IOPRIO_PRIO_CLASS(ioprio);
 | |
| 	int data = IOPRIO_PRIO_DATA(ioprio);
 | |
| 	struct task_struct *p, *g;
 | |
| 	struct user_struct *user;
 | |
| 	struct pid *pgrp;
 | |
| 	int ret;
 | |
| 
 | |
| 	switch (class) {
 | |
| 		case IOPRIO_CLASS_RT:
 | |
| 			if (!capable(CAP_SYS_ADMIN))
 | |
| 				return -EPERM;
 | |
| 			/* fall through, rt has prio field too */
 | |
| 		case IOPRIO_CLASS_BE:
 | |
| 			if (data >= IOPRIO_BE_NR || data < 0)
 | |
| 				return -EINVAL;
 | |
| 
 | |
| 			break;
 | |
| 		case IOPRIO_CLASS_IDLE:
 | |
| 			break;
 | |
| 		case IOPRIO_CLASS_NONE:
 | |
| 			if (data)
 | |
| 				return -EINVAL;
 | |
| 			break;
 | |
| 		default:
 | |
| 			return -EINVAL;
 | |
| 	}
 | |
| 
 | |
| 	ret = -ESRCH;
 | |
| 	rcu_read_lock();
 | |
| 	switch (which) {
 | |
| 		case IOPRIO_WHO_PROCESS:
 | |
| 			if (!who)
 | |
| 				p = current;
 | |
| 			else
 | |
| 				p = find_task_by_vpid(who);
 | |
| 			if (p)
 | |
| 				ret = set_task_ioprio(p, ioprio);
 | |
| 			break;
 | |
| 		case IOPRIO_WHO_PGRP:
 | |
| 			if (!who)
 | |
| 				pgrp = task_pgrp(current);
 | |
| 			else
 | |
| 				pgrp = find_vpid(who);
 | |
| 			do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
 | |
| 				ret = set_task_ioprio(p, ioprio);
 | |
| 				if (ret)
 | |
| 					break;
 | |
| 			} while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
 | |
| 			break;
 | |
| 		case IOPRIO_WHO_USER:
 | |
| 			if (!who)
 | |
| 				user = current_user();
 | |
| 			else
 | |
| 				user = find_user(who);
 | |
| 
 | |
| 			if (!user)
 | |
| 				break;
 | |
| 
 | |
| 			do_each_thread(g, p) {
 | |
| 				if (__task_cred(p)->uid != who)
 | |
| 					continue;
 | |
| 				ret = set_task_ioprio(p, ioprio);
 | |
| 				if (ret)
 | |
| 					goto free_uid;
 | |
| 			} while_each_thread(g, p);
 | |
| free_uid:
 | |
| 			if (who)
 | |
| 				free_uid(user);
 | |
| 			break;
 | |
| 		default:
 | |
| 			ret = -EINVAL;
 | |
| 	}
 | |
| 
 | |
| 	rcu_read_unlock();
 | |
| 	return ret;
 | |
| }
 | |
| 
 | |
| static int get_task_ioprio(struct task_struct *p)
 | |
| {
 | |
| 	int ret;
 | |
| 
 | |
| 	ret = security_task_getioprio(p);
 | |
| 	if (ret)
 | |
| 		goto out;
 | |
| 	ret = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, IOPRIO_NORM);
 | |
| 	if (p->io_context)
 | |
| 		ret = p->io_context->ioprio;
 | |
| out:
 | |
| 	return ret;
 | |
| }
 | |
| 
 | |
| int ioprio_best(unsigned short aprio, unsigned short bprio)
 | |
| {
 | |
| 	unsigned short aclass = IOPRIO_PRIO_CLASS(aprio);
 | |
| 	unsigned short bclass = IOPRIO_PRIO_CLASS(bprio);
 | |
| 
 | |
| 	if (aclass == IOPRIO_CLASS_NONE)
 | |
| 		aclass = IOPRIO_CLASS_BE;
 | |
| 	if (bclass == IOPRIO_CLASS_NONE)
 | |
| 		bclass = IOPRIO_CLASS_BE;
 | |
| 
 | |
| 	if (aclass == bclass)
 | |
| 		return min(aprio, bprio);
 | |
| 	if (aclass > bclass)
 | |
| 		return bprio;
 | |
| 	else
 | |
| 		return aprio;
 | |
| }
 | |
| 
 | |
| SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
 | |
| {
 | |
| 	struct task_struct *g, *p;
 | |
| 	struct user_struct *user;
 | |
| 	struct pid *pgrp;
 | |
| 	int ret = -ESRCH;
 | |
| 	int tmpio;
 | |
| 
 | |
| 	rcu_read_lock();
 | |
| 	switch (which) {
 | |
| 		case IOPRIO_WHO_PROCESS:
 | |
| 			if (!who)
 | |
| 				p = current;
 | |
| 			else
 | |
| 				p = find_task_by_vpid(who);
 | |
| 			if (p)
 | |
| 				ret = get_task_ioprio(p);
 | |
| 			break;
 | |
| 		case IOPRIO_WHO_PGRP:
 | |
| 			if (!who)
 | |
| 				pgrp = task_pgrp(current);
 | |
| 			else
 | |
| 				pgrp = find_vpid(who);
 | |
| 			do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
 | |
| 				tmpio = get_task_ioprio(p);
 | |
| 				if (tmpio < 0)
 | |
| 					continue;
 | |
| 				if (ret == -ESRCH)
 | |
| 					ret = tmpio;
 | |
| 				else
 | |
| 					ret = ioprio_best(ret, tmpio);
 | |
| 			} while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
 | |
| 			break;
 | |
| 		case IOPRIO_WHO_USER:
 | |
| 			if (!who)
 | |
| 				user = current_user();
 | |
| 			else
 | |
| 				user = find_user(who);
 | |
| 
 | |
| 			if (!user)
 | |
| 				break;
 | |
| 
 | |
| 			do_each_thread(g, p) {
 | |
| 				if (__task_cred(p)->uid != user->uid)
 | |
| 					continue;
 | |
| 				tmpio = get_task_ioprio(p);
 | |
| 				if (tmpio < 0)
 | |
| 					continue;
 | |
| 				if (ret == -ESRCH)
 | |
| 					ret = tmpio;
 | |
| 				else
 | |
| 					ret = ioprio_best(ret, tmpio);
 | |
| 			} while_each_thread(g, p);
 | |
| 
 | |
| 			if (who)
 | |
| 				free_uid(user);
 | |
| 			break;
 | |
| 		default:
 | |
| 			ret = -EINVAL;
 | |
| 	}
 | |
| 
 | |
| 	rcu_read_unlock();
 | |
| 	return ret;
 | |
| }
 |