lkml.org 
[lkml]   [2018]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [RFC] locking/rwsem: Avoid issuing wakeup before setting the reader waiter to nil
On Thu, Nov 29, 2018 at 06:27:00PM +0100, Peter Zijlstra wrote:
>
> wake_up_q() should, per the barriers in wake_up_process, ensure that if
> wake_a_add() fails, there will be a wakeup of that task after that
> point.
>
> So if we put wake_up_q() at the location where wake_up_process() should
> be, it should all work.
>
> The bug in question is that it can happen at any time after
> wake_q_add(), not necessarily at wake_up_q().

Hmm, I think we're missing a barrier in wake_q_add(); when cmpxchg()
fails we still need an smp_mb().

Something like so.

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 3d87a28da378..69def558edf6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -400,6 +400,13 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
{
struct wake_q_node *node = &task->wake_q;

+ /*
+ * Ensure, that when the below cmpxchg() fails, the corresponding
+ * wake_up_q() will observe our prior state.
+ *
+ * Pairs with the smp_mb() from wake_up_q()'s wake_up_process().
+ */
+ smp_mb();
/*
* Atomically grab the task, if ->wake_q is !nil already it means
* its already queued (either by us or someone else) and will get the
@@ -408,7 +415,7 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
* This cmpxchg() executes a full barrier, which pairs with the full
* barrier executed by the wakeup in wake_up_q().
*/
- if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL))
+ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL))
return;

get_task_struct(task);
\
 
 \ /
  Last update: 2018-11-29 19:09    [W:0.105 / U:1.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site