Commit 5cdfd174 authored by Paul E. McKenney's avatar Paul E. McKenney
Browse files

srcu: Check for in-flight callbacks in _cleanup_srcu_struct()



If someone fails to drain the corresponding SRCU callbacks (for
example, by failing to invoke srcu_barrier()) before invoking either
cleanup_srcu_struct() or cleanup_srcu_struct_quiesced(), the resulting
diagnostic is an ambiguous use-after-free diagnostic, and even then
only if you are running something like KASAN.  This commit therefore
improves SRCU diagnostics by adding checks for in-flight callbacks at
_cleanup_srcu_struct() time.

Note that these diagnostics can still be defeated, for example, by
invoking call_srcu() concurrently with cleanup_srcu_struct().  Which is
a really bad idea, but sometimes all too easy to do.  But even then,
these diagnostics have at least some probability of catching the problem.

Reported-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reported-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.ibm.com>
Tested-by: default avatarBart Van Assche <bvanassche@acm.org>
parent 9e98c678
Loading
Loading
Loading
Loading
+2 −0
Original line number Diff line number Diff line
@@ -387,6 +387,8 @@ void _cleanup_srcu_struct(struct srcu_struct *ssp, bool quiesced)
			del_timer_sync(&sdp->delay_work);
			flush_work(&sdp->work);
		}
		if (WARN_ON(rcu_segcblist_n_cbs(&sdp->srcu_cblist)))
			return; /* Forgot srcu_barrier(), so just leak it! */
	}
	if (WARN_ON(rcu_seq_state(READ_ONCE(ssp->srcu_gp_seq)) != SRCU_STATE_IDLE) ||
	    WARN_ON(srcu_readers_active(ssp))) {