LIST_POISON with rcu

Hi,

LIST_POISON will not work with RCU based lists as we depend on the fact the deleted list element can still point to the existing list. Though any new user will not be able to reach the deleted element. This is one of the reasons why we don't do list_del_init_rcu(). The folloing patch fixes this.

Trond, I am not sure if you are seeing the d_move() oops because of this. It will be nice if you can post the oops message also.

Regards,
Maneesh

diff -urN linux-2.5.70-mm8/include/linux/list.h linux-2.5.70-mm8-LIST_POISON/include/linux/list.h
@@ -162,8 +162,6 @@
 static inline void list_del_rcu(struct list_head *entry)
 {
 	__list_del(entry->prev, entry->next);
-	entry->next = LIST_POISON1;
-	entry->prev = LIST_POISON2;
 }
 
 /**

@@ -434,7 +432,10 @@
 	n->pprev = LIST_POISON2;
 }
 
-#define hlist_del_rcu hlist_del  /* list_del_rcu is identical too? */
+static __inline__ void hlist_del_rcu(struct hlist_node *n)
+{
+	__hlist_del(n);
+}
 
 static __inline__ void hlist_del_init(struct hlist_node *n) 
 {

Maneesh Soni
IBM Linux Technology Center, 
IBM India Software Lab, Bangalore.
Phone: +91-80-5044999 email: [email protected]
http://lse.sourceforge.net/

> LIST_POISON will not work with RCU based lists as we depend on > the fact the deleted list element can still point to the > existing list.

Then you have a clear problem: you'll need some way of marking the node as hashed or unhashed, other than testing those pointers.

> Trond, I am not sure if you are seeing the d_move() oops > because of this. It will be nice if you can post the oops > message also.

The d_move Oops is not a direct consequence of the hlist_del_rcu poisoning since d_drop now uses hlist_del_rcu_init. The effect is the same though, as you can see below.

printing eip:
c019221c
*pde = 00000000

Oops: 0002 [#1]
CPU:    0
EIP:    0060:[<c019221c>]    Not tainted
EFLAGS: 00010246

EIP is at d_move+0x1e8/0x8b2
eax: 00000000 ebx: de8935c0 ecx: de893648 edx: 00000000
esi: de54129c edi: d6414a80 ebp: d4b01e24 esp: d4b01de8
ds: 007b es: 007b ss: 0068
Process mv (pid: 1496, threadinfo=d4b00000 task=dacd1e80)

Stack: 14380000 3ee795f2 d9780000 3ee795f2 d9780000 d4b01e10 c01531b3 d6414b3c
       00000000 ffffffff d4b01e24 0005aad1 d4b01e40 de54129c d6414a80 d4b01e94
       e1a7f254 de8935c0 de54129c d6414a80 d4b01e78 00000002 73666e2e 32313030
Call Trace:
 [<c01531b3>] invalidate_inode_pages+0x21/0x26
 [<e1a7f254>] nfs_sillyrename+0x198/0x214 [nfs]
 [<e1a80585>] nfs_rename+0x41d/0x59c [nfs]
 [<c0185c86>] vfs_rename_other+0xd6/0xda
 [<c0185dcc>] vfs_rename+0x142/0x3a8
 [<c01861db>] sys_rename+0x1a9/0x1d6
 [<c017d0d7>] sys_lstat64+0x35/0x38
 [<c010bdd7>] syscall_call+0x7/0xb

Code: 89 02 74 03 89 50 04 c7 83 88 00 00 00 00 01 10 00 c7 41 04

Cheers,
Trond