Re: PATCH? hrtimer_wakeup: fix a theoretical race wrt rt_mutex_slowlock()

From: Oleg Nesterov
Date: Mon Nov 06 2006 - 06:08:01 EST


On 11/05, Linus Torvalds wrote:
>
> On Sun, 5 Nov 2006, Steven Rostedt wrote:
> >
> > This whole situation is very theoretical, but I think this actually can
> > happen *theoretically*.
> >
> > OK, the spin_lock doesn't do any serialization, but the unlock does. But
> > the problem can happen before the unlock. Because of the loop.
> >
> > CPU 1 CPU 2
> >
> > task_rq_lock()
> >
> > p->state = TASK_RUNNING;
> >
> >
> > (from bottom of for loop)
> > set_current_state(TASK_INTERRUPTIBLE);
> >
> > for (;;) { (looping)
> >
> > if (timeout && !timeout->task)
> >
> >
> > (now CPU implements)
> > t->task = NULL
> >
> > task_rq_unlock();
> >
> > schedule() (with state == TASK_INTERRUPTIBLE)
>
> Yeah, that seems a real bug. You _always_ need to actually do the thing
> that you wait for _before_ you want it up. That's what all the scheduling
> primitives depend on - you can't wake people up first, and then set the
> condition variable.
>
> So if a rt_mutex depeds on something that is set inside the rq-lock, it
> needs to get the task rw-lock in order to check it.

No, rt_mutex is fine (I think).

My changelog was very unclean and confusing, I'll try again. What we are
doing is:

rt_mutex_slowlock:

task->state = TASK_INTERRUPTIBLE;

mb();

if (CONDITION)
return -ETIMEDOUT;

schedule();

This is common and correct.

hrtimer_wakeup:

CONDITION = 1; // [1]

spin_lock(rq->lock);

task->state = TASK_RUNNING; // [2]

This needs 'wmb()' between [1] and [2] unless spin_lock() garantees memory
ordering. Of course, rt_mutex can take rq->lock to solve this, but I don't
think it would be right.

Oleg.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/