From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754372AbcB2Lll (ORCPT ); Mon, 29 Feb 2016 06:41:41 -0500 Received: from mail-pf0-f194.google.com ([209.85.192.194]:35700 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752021AbcB2Llj (ORCPT ); Mon, 29 Feb 2016 06:41:39 -0500 From: Jianyu Zhan To: linux-kernel@vger.kernel.org Cc: tglx@linutronix.de, dave@stgolabs.net, peterz@infradead.org, akpm@linux-foundation.org, mingo@kernel.org, dvhart@linux.intel.com, bigeasy@linutronix.de, nasa4836@gmail.com Subject: [PATCH] futex: replace bare barrier() with a READ_ONCE() Date: Mon, 29 Feb 2016 19:41:33 +0800 Message-Id: <1456746093-10578-1-git-send-email-nasa4836@gmail.com> X-Mailer: git-send-email 2.4.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit e91467ecd1ef ("bug in futex unqueue_me") introduces a barrier() in unqueue_me(), to address a pointer aliasing problem in s390x, between q->lock_ptr and local variable lock_ptr. Since there is a retry logic to reload q->lock_ptr into local variable lock_ptr, s390x generates code that aliases q->lock_ptr with lock_ptr, while q->lock_ptr might change between retries, which beats the alias and causes problem. This patch replaces this bare barrier() with a READ_ONCE(), a weaker form of barrier(), which could be more informative. And furthermore, this retry logic is effectively the same with: while (lock_ptr = q->lock_ptr) do_something_with(lock_ptr); and compiler is at its will to merge successive load of q->lock_ptr, which is also problematic at this scenario. READ_ONCE() can avoid this problem. Signed-off-by: Jianyu Zhan --- kernel/futex.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index 5d6ce64..20e8466 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -1927,8 +1927,12 @@ static int unqueue_me(struct futex_q *q) /* In the common case we don't take the spinlock, which is nice. */ retry: - lock_ptr = q->lock_ptr; - barrier(); + /* + * q->lock_ptr can change and a pointer aliasing(of lock_ptr) will cause problem, + * and also to avoid potential compiler merging of successive load of q->lock_ptr under + * this retry logic, so we use READ_ONCE() here. + */ + lock_ptr = READ_ONCE(q->lock_ptr); if (lock_ptr != NULL) { spin_lock(lock_ptr); /* -- 2.4.3