Skip to contentSkip to conversation

2.4.21-rc1 Close rmmod race on ia64

PATCH In review Keith Owens 3 participants 4 messages May 13, 2003 – May 14, 2003

lore
Share & tools
lore

Keith Owens

author
#0 lore raw

PATCH 1/1 2.4.21-rc1 Close rmmod race on ia64

ia64 is not taking the spinlock that closes the race between module removal and traversal of exception tables. It can result in oops when one cpu takes an exception while another is unloading a module.

Other architectures take this lock. The patch is almost a cut and paste from i386, plus it removes a dead variable.

arch/ia64/mm/extable.c +6 -2
diff -urp 2.4.21-rc1-ia64.orig/arch/ia64/mm/extable.c 2.4.21-rc1-ia64/arch/ia64/mm/extable.c
@@ -38,6 +38,8 @@ search_one_table (const struct exception
 register unsigned long main_gp __asm__("gp");
 #endif
 
+extern spinlock_t modlist_lock;
+
 struct exception_fixup
 search_exception_table (unsigned long addr)
 {

@@ -51,10 +53,11 @@ search_exception_table (unsigned long ad
 		fix.cont = entry->cont + main_gp;
 	return fix;
 #else
-	struct archdata *archdata;
+	unsigned long flags;
 	struct module *mp;
 
 	/* The kernel is the last "module" -- no need to treat it special. */
+	spin_lock_irqsave(&modlist_lock, flags);
 	for (mp = module_list; mp; mp = mp->next) {
 		if (!mp->ex_table_start)
 			continue;

@@ -65,9 +68,10 @@ search_exception_table (unsigned long ad
 					 addr, (unsigned long) archdata->gp);
 		if (entry) {
 			fix.cont = entry->cont + (unsigned long) archdata->gp;
-			return fix;
+			break;
 		}
 	}
+	spin_unlock_irqrestore(&modlist_lock, flags);
 #endif
 	return fix;
 }
#1 lore raw

Keith Owens <[email protected]> writes:

|> @@ -51,10 +53,11 @@ search_exception_table (unsigned long ad
|>  		fix.cont = entry->cont + main_gp;
|>  	return fix;
|>  #else
|> -	struct archdata *archdata;

??? archdata is still needed.

Andreas.

Signature · 4 lines
Andreas Schwab, SuSE Labs, [email protected]
SuSE Linux AG, Deutschherrnstr. 15-19, D-90429 Nürnberg
Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."
#2 lore raw
In reply to Keith Owens
Quoted 6 lines · Keith Owens

ia64 is not taking the spinlock that closes the race between module removal and traversal of exception tables. It can result in oops when one cpu takes an exception while another is unloading a module.

Other architectures take this lock. The patch is almost a cut and paste from i386, plus it removes a dead variable.

Applied for 2.4 (except I left in the archdata decl). Thanks!

author
#3 lore raw
In reply to Keith Owens
Quoted 9 lines · Andreas Schwab

Keith Owens <[email protected]> writes:

|> @@ -51,10 +53,11 @@ search_exception_table (unsigned long ad
|>  		fix.cont = entry->cont + main_gp;
|>  	return fix;
|>  #else
|> -	struct archdata *archdata;

??? archdata is still needed.

I did the original patch against 2.4.20 which does not have archdata then I made an error on the merge up to 2.4.21-rc1. -ENOTENOUGHSLEEP.