rhashtable: Fix walker list corruption (c6ff5268) · Commits · 戴 / test

The commit ("rhashtable: Fix sleeping inside RCU critical section in walk_stop") introduced a new spinlock for the walker list. However, it did not convert all existing users of the list over to the new spin lock. Some continued to use the old mutext for this purpose. This obviously led to corruption of the list. The fix is to use the spin lock everywhere where we touch the list. This also allows us to do rcu_rad_lock before we take the lock in rhashtable_walk_start. With the old mutex this would've deadlocked but it's safe with the new spin lock. Fixes: ("rhashtable: Fix sleeping inside RCU...") Reported-by:

Colin Ian King <colin.king@canonical.com> Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:

David S. Miller <davem@davemloft.net>

lib/rhashtable.c

+7 −9

Original line number	Diff line number	Diff line
		@@ -518,10 +518,10 @@ int rhashtable_walk_init(struct rhashtable ht, struct rhashtable_iter iter)
		if (!iter->walker)
		return -ENOMEM;

		mutex_lock(&ht->mutex);
		spin_lock(&ht->lock);
		iter->walker->tbl = rht_dereference(ht->tbl, ht);
		list_add(&iter->walker->list, &iter->walker->tbl->walkers);
		mutex_unlock(&ht->mutex);
		spin_unlock(&ht->lock);

		return 0;
		}
		@@ -535,10 +535,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
		*/
		void rhashtable_walk_exit(struct rhashtable_iter *iter)
		{
		mutex_lock(&iter->ht->mutex);
		spin_lock(&iter->ht->lock);
		if (iter->walker->tbl)
		list_del(&iter->walker->list);
		mutex_unlock(&iter->ht->mutex);
		spin_unlock(&iter->ht->lock);
		kfree(iter->walker);
		}
		EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
		@@ -562,14 +562,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
		{
		struct rhashtable *ht = iter->ht;

		mutex_lock(&ht->mutex);
		rcu_read_lock();

		spin_lock(&ht->lock);
		if (iter->walker->tbl)
		list_del(&iter->walker->list);

		rcu_read_lock();

		mutex_unlock(&ht->mutex);
		spin_unlock(&ht->lock);

		if (!iter->walker->tbl) {
		iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);

Admin message