From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1756595AbbFPLJ0 (ORCPT <rfc822;w@1wt.eu>);
	Tue, 16 Jun 2015 07:09:26 -0400
Received: from bombadil.infradead.org ([198.137.202.9]:56404 "EHLO
	bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1754614AbbFPLJQ (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Tue, 16 Jun 2015 07:09:16 -0400
Date: Tue, 16 Jun 2015 13:08:55 +0200
From: Peter Zijlstra <peterz@infradead.org>
To: Oleg Nesterov <oleg@redhat.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>, tj@kernel.org,
        mingo@redhat.com, linux-kernel@vger.kernel.org, der.herr@hofr.at,
        dave@stgolabs.net, torvalds@linux-foundation.org,
        josh@joshtriplett.org
Subject: Re: ring_buffer_attach && cond_synchronize_rcu (Was: percpu-rwsem:
 Optimize readers and reduce global impact)
Message-ID: <20150616110855.GM3644@twins.programming.kicks-ass.net>
References: <20150526114356.609107918@infradead.org>
 <20150526120215.042527659@infradead.org>
 <20150530171806.GB14999@linux.vnet.ibm.com>
 <20150530200425.GA15748@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150530200425.GA15748@redhat.com>
User-Agent: Mutt/1.5.21 (2012-12-30)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sat, May 30, 2015 at 10:04:25PM +0200, Oleg Nesterov wrote:
> And. I tried to find other users of get_state/cond_sync. Found
> ring_buffer_attach() and it looks obviously buggy?

Urgh, indeed.

> IOW. Suppose that ring_buffer_attach() preempts right_after
> get_state_synchronize_rcu() and gp completes before spin_lock().
> 
> In this case cond_synchronize_rcu() does nothing and we reuse
> ->rb_entry without waiting for gp in between?

Yes.

> Don't we need the patch below? (it also moves the ->rcu_pending check
> under "if (rb)", to make it more readable imo).

> --- x/kernel/events/core.c
> +++ x/kernel/events/core.c
> @@ -4310,20 +4310,20 @@ static void ring_buffer_attach(struct pe
>  		WARN_ON_ONCE(event->rcu_pending);
>  
>  		spin_lock_irqsave(&old_rb->event_lock, flags);
>  		list_del_rcu(&event->rb_entry);
>  		spin_unlock_irqrestore(&old_rb->event_lock, flags);
>  
> +		event->rcu_batches = get_state_synchronize_rcu();
> +		event->rcu_pending = 1;
>  	}
>  
>  	if (rb) {
> +		if (event->rcu_pending) {
> +			cond_synchronize_rcu(event->rcu_batches);
> +			event->rcu_pending = 0;
> +		}
> +
>  		spin_lock_irqsave(&rb->event_lock, flags);
>  		list_add_rcu(&event->rb_entry, &rb->event_list);
>  		spin_unlock_irqrestore(&rb->event_lock, flags);

Agreed.