Skip to content
  • Mikulas Patocka's avatar
    user namespace: fix incorrect memory barriers · e79323bd
    Mikulas Patocka authored
    
    
    smp_read_barrier_depends() can be used if there is data dependency between
    the readers - i.e. if the read operation after the barrier uses address
    that was obtained from the read operation before the barrier.
    
    In this file, there is only control dependency, no data dependecy, so the
    use of smp_read_barrier_depends() is incorrect. The code could fail in the
    following way:
    * the cpu predicts that idx < entries is true and starts executing the
      body of the for loop
    * the cpu fetches map->extent[0].first and map->extent[0].count
    * the cpu fetches map->nr_extents
    * the cpu verifies that idx < extents is true, so it commits the
      instructions in the body of the for loop
    
    The problem is that in this scenario, the cpu read map->extent[0].first
    and map->nr_extents in the wrong order. We need a full read memory barrier
    to prevent it.
    
    Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    e79323bd