• Thomas Gleixner's avatar
    uids: Prevent tear down race · b00bc0b2
    Thomas Gleixner authored
    Ingo triggered the following warning:
    
    WARNING: at lib/debugobjects.c:255 debug_print_object+0x42/0x50()
    Hardware name: System Product Name
    ODEBUG: init active object type: timer_list
    Modules linked in:
    Pid: 2619, comm: dmesg Tainted: G        W  2.6.32-rc5-tip+ #5298
    Call Trace:
     [<81035443>] warn_slowpath_common+0x6a/0x81
     [<8120e483>] ? debug_print_object+0x42/0x50
     [<81035498>] warn_slowpath_fmt+0x29/0x2c
     [<8120e483>] debug_print_object+0x42/0x50
     [<8120ec2a>] __debug_object_init+0x279/0x2d7
     [<8120ecb3>] debug_object_init+0x13/0x18
     [<810409d2>] init_timer_key+0x17/0x6f
     [<81041526>] free_uid+0x50/0x6c
     [<8104ed2d>] put_cred_rcu+0x61/0x72
     [<81067fac>] rcu_do_batch+0x70/0x121
    
    debugobjects warns about an enqueued timer being initialized. If
    CONFIG_USER_SCHED=y the user management code uses delayed work to
    remove the user from the hash table and tear down the sysfs objects.
    
    free_uid is called from RCU and initializes/schedules delayed work if
    the usage count of the user_struct is 0. The init/schedule happens
    outside of the uidhash_lock protected region which allows a concurrent
    caller of find_user() to reference the about to be destroyed
    user_struct w/o preventing the work from being scheduled. If the next
    free_uid call happens before the work timer expired then the active
    timer is initialized and the work scheduled again.
    
    The race was introduced in commit 5cb350ba (sched: group scheduling,
    sysfs tunables) and made more prominent by commit 3959214f (sched:
    delayed cleanup of user_struct)
    
    Move the init/schedule_delayed_work inside of the uidhash_lock
    protected region to prevent the race.
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Acked-by: default avatarDhaval Giani <dhaval@linux.vnet.ibm.com>
    Cc: Paul E. McKenney <paulmck@us.ibm.com>
    Cc: Kay Sievers <kay.sievers@vrfy.org>
    Cc: stable@kernel.org
    b00bc0b2
user.c 12.2 KB