提交 66339c31 编写于 作者: K Kirill Tkhai 提交者: Ingo Molnar

sched: Use dl_bw_of() under RCU read lock

dl_bw_of() dereferences rq->rd which has to have RCU read lock held.
Probability of use-after-free isn't zero here.

Also add lockdep assert into dl_bw_cpus().
Signed-off-by: NKirill Tkhai <ktkhai@parallels.com>
Signed-off-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org> # v3.14+
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20140922183624.11015.71558.stgit@localhostSigned-off-by: NIngo Molnar <mingo@kernel.org>
上级 7a96c231
...@@ -2021,6 +2021,8 @@ unsigned long to_ratio(u64 period, u64 runtime) ...@@ -2021,6 +2021,8 @@ unsigned long to_ratio(u64 period, u64 runtime)
#ifdef CONFIG_SMP #ifdef CONFIG_SMP
inline struct dl_bw *dl_bw_of(int i) inline struct dl_bw *dl_bw_of(int i)
{ {
rcu_lockdep_assert(rcu_read_lock_sched_held(),
"sched RCU must be held");
return &cpu_rq(i)->rd->dl_bw; return &cpu_rq(i)->rd->dl_bw;
} }
...@@ -2029,6 +2031,8 @@ static inline int dl_bw_cpus(int i) ...@@ -2029,6 +2031,8 @@ static inline int dl_bw_cpus(int i)
struct root_domain *rd = cpu_rq(i)->rd; struct root_domain *rd = cpu_rq(i)->rd;
int cpus = 0; int cpus = 0;
rcu_lockdep_assert(rcu_read_lock_sched_held(),
"sched RCU must be held");
for_each_cpu_and(i, rd->span, cpu_active_mask) for_each_cpu_and(i, rd->span, cpu_active_mask)
cpus++; cpus++;
...@@ -7645,6 +7649,8 @@ static int sched_dl_global_constraints(void) ...@@ -7645,6 +7649,8 @@ static int sched_dl_global_constraints(void)
int cpu, ret = 0; int cpu, ret = 0;
unsigned long flags; unsigned long flags;
rcu_read_lock();
/* /*
* Here we want to check the bandwidth not being set to some * Here we want to check the bandwidth not being set to some
* value smaller than the currently allocated bandwidth in * value smaller than the currently allocated bandwidth in
...@@ -7666,6 +7672,8 @@ static int sched_dl_global_constraints(void) ...@@ -7666,6 +7672,8 @@ static int sched_dl_global_constraints(void)
break; break;
} }
rcu_read_unlock();
return ret; return ret;
} }
...@@ -7681,6 +7689,7 @@ static void sched_dl_do_global(void) ...@@ -7681,6 +7689,7 @@ static void sched_dl_do_global(void)
if (global_rt_runtime() != RUNTIME_INF) if (global_rt_runtime() != RUNTIME_INF)
new_bw = to_ratio(global_rt_period(), global_rt_runtime()); new_bw = to_ratio(global_rt_period(), global_rt_runtime());
rcu_read_lock();
/* /*
* FIXME: As above... * FIXME: As above...
*/ */
...@@ -7691,6 +7700,7 @@ static void sched_dl_do_global(void) ...@@ -7691,6 +7700,7 @@ static void sched_dl_do_global(void)
dl_b->bw = new_bw; dl_b->bw = new_bw;
raw_spin_unlock_irqrestore(&dl_b->lock, flags); raw_spin_unlock_irqrestore(&dl_b->lock, flags);
} }
rcu_read_unlock();
} }
static int sched_rt_global_validate(void) static int sched_rt_global_validate(void)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册