Commit 54539cd2 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

Pull percpu fix from Tejun Heo:
 "It is very late but this is an important percpu-refcount fix from
  Sebastian Ott.

  The problem is that percpu_ref_*() used __this_cpu_*() instead of
  this_cpu_*().  The difference between the two is that the latter is
  atomic on the local cpu while the former is not.  this_cpu_inc() is
  guaranteed to increment the percpu counter on the cpu that the
  operation is executed on without any synchronization; however,
  __this_cpu_inc() doesn't and if the local cpu invokes the function
  from different contexts (e.g.  process and irq) of the same CPU, it's
  not guaranteed to actually increment as it may be implemented as rmw.

  This bug existed from the get-go but it hasn't been noticed earlier
  probably because on x86 __this_cpu_inc() is equivalent to
  this_cpu_inc() as both get translated into single instruction;
  however, s390 uses the generic rmw implementation and gets affected by
  the bug.  Kudos to Sebastian and Heiko for diagnosing it.

  The change is very low risk and fixes a critical issue on the affected
  architectures, so I think it's a good candidate for inclusion although
  it's very late in the devel cycle.  On the other hand, this has been
  broken since v3.11, so backporting it through -stable post -rc1 won't
  be the end of the world.

  I'll ping Christoph whether __this_cpu_*() ops can be better annotated
  so that it can trigger lockdep warning when used from multiple
  contexts"

* 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
  percpu-refcount: fix usage of this_cpu_ops
parents c717d156 0c36b390
...@@ -110,7 +110,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref) ...@@ -110,7 +110,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref)
pcpu_count = ACCESS_ONCE(ref->pcpu_count); pcpu_count = ACCESS_ONCE(ref->pcpu_count);
if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR)) if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR))
__this_cpu_inc(*pcpu_count); this_cpu_inc(*pcpu_count);
else else
atomic_inc(&ref->count); atomic_inc(&ref->count);
...@@ -139,7 +139,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref) ...@@ -139,7 +139,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref)
pcpu_count = ACCESS_ONCE(ref->pcpu_count); pcpu_count = ACCESS_ONCE(ref->pcpu_count);
if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR)) { if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR)) {
__this_cpu_inc(*pcpu_count); this_cpu_inc(*pcpu_count);
ret = true; ret = true;
} }
...@@ -164,7 +164,7 @@ static inline void percpu_ref_put(struct percpu_ref *ref) ...@@ -164,7 +164,7 @@ static inline void percpu_ref_put(struct percpu_ref *ref)
pcpu_count = ACCESS_ONCE(ref->pcpu_count); pcpu_count = ACCESS_ONCE(ref->pcpu_count);
if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR)) if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR))
__this_cpu_dec(*pcpu_count); this_cpu_dec(*pcpu_count);
else if (unlikely(atomic_dec_and_test(&ref->count))) else if (unlikely(atomic_dec_and_test(&ref->count)))
ref->release(ref); ref->release(ref);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment