Re: [PATCH 2/2] ipvs: Use cond_resched_rcu_lock() helper when dumping co

To: paulmck@xxxxxxxxxxxxxxxxxx
Subject: Re: [PATCH 2/2] ipvs: Use cond_resched_rcu_lock() helper when dumping connections
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>, Simon Horman <horms@xxxxxxxxxxxx>, Julian Anastasov <ja@xxxxxx>, Ingo Molnar <mingo@xxxxxxxxxx>, lvs-devel@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxxxxxx, netfilter-devel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>, Dipankar Sarma <dipankar@xxxxxxxxxx>, dhaval.giani@xxxxxxxxx
From: Eric Dumazet <eric.dumazet@xxxxxxxxx>
Date: Fri, 26 Apr 2013 08:59:07 -0700
On Fri, 2013-04-26 at 08:45 -0700, Paul E. McKenney wrote:

> I have done some crude coccinelle patterns in the past, but they are
> subject to false positives (from when you transfer the pointer from
> RCU protection to reference-count protection) and also false negatives
> (when you atomically increment some statistic unrelated to protection).
> I could imagine maintaining a per-thread count of the number of outermost
> RCU read-side critical sections at runtime, and then associating that
> counter with a given pointer at rcu_dereference() time, but this would
> require either compiler magic or an API for using a pointer returned
> by rcu_dereference().  This API could in theory be enforced by sparse.
> Dhaval Giani might have some ideas as well, adding him to CC.

We had this fix the otherday, because tcp prequeue code hit this check :

static inline struct dst_entry *skb_dst(const struct sk_buff *skb)
        /* If refdst was not refcounted, check we still are in a 
         * rcu_read_lock section
        WARN_ON((skb->_skb_refdst & SKB_DST_NOREF) &&
                !rcu_read_lock_held() &&
        return (struct dst_entry *)(skb->_skb_refdst & SKB_DST_PTRMASK);


Problem is the rcu protected pointer was escaping the rcu lock and was
then used in another thread.

What would be cool (but expensive maybe) , would be to get a cookie from
rcu_read_lock(), and check the cookie at rcu_dereference(). These
cookies would have system wide scope to catch any kind of errors.

Because a per thread counter would not catch following problem :


ptr = rcu_dereference(x);
if (!ptr)
        return NULL;


/* no reload of x, ptr might be now stale/freed */
if (ptr->field) { ... }

To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at

<Prev in Thread] Current Thread [Next in Thread>