Re: [Lse-tech] Re: [PATCH 0/7]: Fix for unsafe notifier chain

[Paul E. M. <pa...@us...>]

On Mon, Nov 28, 2005 at 01:07:11PM +0100, Andi Kleen wrote:
> On Mon, Nov 28, 2005 at 07:31:36PM +1100, Keith Owens wrote:
> > On Mon, 28 Nov 2005 05:59:22 +0100, 
> > Andi Kleen <ak...@su...> wrote:
> > >On Sun, Nov 27, 2005 at 08:57:45PM -0800, Andrew Morton wrote:
> > >> "Paul E. McKenney" <pa...@us...> wrote:
> > >> >
> > >> > Any options I missed?
> > >> 
> > >> Stop using the notifier chains from NMI context - it's too hard.  Use a
> > >> fixed-size array in the NMI code instead.
> > >
> > >Or just don't unregister. That is what I did for the debug notifiers.
> > 
> > Unregister is not the only problem.  Chain traversal races with
> > register as well.
> 
> Either it follows the old next or the new next. Both are valid.
> The only problem is that there isn't a write barrier between
> 
>  n->next = *list;
>  *list=n;
> 
> in notifier_chain_register, which might hit on non i386 architectures. 

Coding as follows:

	n->next = *list;
	rcu_assign_pointer(*list, n);

will provide memory barriers as needed, even if you are never removing
elements.

						Thanx, Paul