[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH] linux-2.6.18: netback: take net_schedule_list_lock when removing entry from net_schedule_list



Hi,

On 11/02/10 09:13, Jan Beulich wrote:
From: Ian Campbell<ian.campbell@xxxxxxxxxx>

There is a race in net_tx_build_mops between checking if
net_schedule_list is empty and actually dequeuing the first entry on
the list. If another thread dequeues the only entry on the list during
this window we crash because list_first_entry expects a non-empty
list, like so:

[trace snipped]

I can't find a net_tx_build_mops() function in 2.6.18. I believe I can see what the patch does (*), but for 2.6.18, I think the consequences of popping one from an empty list differ from the above.

Therefore, can somebody please describe how to reproduce this bug? What steps did lead to the NULL dereference in the original 2.6.32 environment?

(*) It takes the locking out of remove_from_net_schedule_list() and moves that reponsibility to the callers of remove_from_net_schedule_list(). This is justified by the difference between call sites: netif_deschedule_work() follows the old behavior, but poll_net_schedule_list() (and transitively, net_tx_action()) needs to lock the following together:
- checking for non-emptiness,
- modifying the first element,
- removing the first element from the list.

I think without the patch the race could result in memory corruption (even if with different consequences than above), but how can one trigger the race?

Thank you,
Laszlo Ersek

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.