Re: [QUESTION] srcu: Remove the SCAN2 state

[Paul E. McKenney]

On Thu, Feb 22, 2018 at 08:57:27AM +0900, Byungchul Park wrote:
> Hello,
> 
> I'm sorry for bothering you, and I seem to be obviously missing
> something, but I'm really wondering why we check try_check_zero()
> again in the state, SCAN1, for the previous srcu_idx.
> 
> I mean, since we've already checked try_check_zero() in the previous
> grace period and gotten 'true' as a return value, all readers who see
> the flipped idx via srcu_flip() won't update the src_{lock,unlock}_count
> for the previous idx until it gets flipped back again.
> 
> Is there any reasons we check try_check_zero() again in the state, SCAN1?
> Is there any problems if the following patch's applied?

Indeed there are!  Removing the second scan exposes us to a nasty race
condition where a reader is preempted (or interrupted or whatever) just
after fetching its counter.  A detailed explanation for an essentially
equivalent race in userspace RCU may be found on the second column of
page 7 of this PDF:

http://www.computer.org/cms/Computer.org/dl/trans/td/2012/02/extras/ttd2012020375s.pdf

But please let me know if I am missing the point of your patch below.

							Thanx, Paul

> Thanks in advance,
> Byungchul
> 
> ---
>  kernel/rcu/srcutree.c | 16 +---------------
>  1 file changed, 1 insertion(+), 15 deletions(-)
> 
> diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
> index 39e50fe..215c44a 100644
> --- a/kernel/rcu/srcutree.c
> +++ b/kernel/rcu/srcutree.c
> @@ -1125,24 +1125,10 @@ static void srcu_advance_state(struct srcu_struct *sp)
>  			mutex_unlock(&sp->srcu_gp_mutex);
>  			return; /* Someone else started the grace period. */
>  		}
> -	}
> -
> -	if (rcu_seq_state(READ_ONCE(sp->srcu_gp_seq)) == SRCU_STATE_SCAN1) {
> -		idx = 1 ^ (sp->srcu_idx & 1);
> -		if (!try_check_zero(sp, idx, 1)) {
> -			mutex_unlock(&sp->srcu_gp_mutex);
> -			return; /* readers present, retry later. */
> -		}
>  		srcu_flip(sp);
> -		rcu_seq_set_state(&sp->srcu_gp_seq, SRCU_STATE_SCAN2);
>  	}
> 
> -	if (rcu_seq_state(READ_ONCE(sp->srcu_gp_seq)) == SRCU_STATE_SCAN2) {
> -
> -		/*
> -		 * SRCU read-side critical sections are normally short,
> -		 * so check at least twice in quick succession after a flip.
> -		 */
> +	if (rcu_seq_state(READ_ONCE(sp->srcu_gp_seq)) == SRCU_STATE_SCAN1) {
>  		idx = 1 ^ (sp->srcu_idx & 1);
>  		if (!try_check_zero(sp, idx, 2)) {
>  			mutex_unlock(&sp->srcu_gp_mutex);
> -- 
> 1.9.1
>