From: Steven Rostedt <rostedt@goodmis.org>
To: Vincent Donnefort <vdonnefort@google.com>
Cc: Breno Leitao <leitao@debian.org>,
Masami Hiramatsu <mhiramat@kernel.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org,
Steven Rostedt <srostedt@redhat.com>,
kernel-team@meta.com, stable@vger.kernel.org
Subject: Re: [PATCH v2] ring-buffer: Handle a reader taking the new head in rb_handle_head_page()
Date: Tue, 10 Nov 2026 02:52:02 -0500 [thread overview]
Message-ID: <20261110025202.78c8c03a@fedora> (raw)
In-Reply-To: <avGQnBjyUMwunknT@google.com>
On Mon, 9 Nov 2026 09:21:32 +0000
Vincent Donnefort <vdonnefort@google.com> wrote:
> > The issue I think you hit was that we have two HEAD pages, when interrupts
> > come in. That is, we can get a state of:
> >
> > --> subbuf --UPDATE--> subbuf --> subbuf --HEAD--> subbuf -->
>
> How we can end-up in this situation? The cmpxch will only swap HEAD for UPDATE.
The cpu_buffer->head_page is only updated by the reader, when it did its last read.
Let's look at it one at a time:
cpu_buffer->head_page
tail |
v v
+--> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf ----> subbuf --+
| |
+---------------------------------------------------------------------+
Then the writer moves the HEAD page around the buffer while there are
no reads happening
cpu_buffer->head_page
tail |
v v
+--> subbuf ----> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf --+
| |
+---------------------------------------------------------------------+
cpu_buffer->head_page
| tail
v v
+--> subbuf ----> subbuf ----> subbuf ----> subbuf --HEAD--> subbuf --+
| |
+---------------------------------------------------------------------+
cpu_buffer->head_page
| tail
v v
+-HEAD-> subbuf ----> subbuf ----> subbuf ----> subbuf ----> subbuf --+
| |
+---------------------------------------------------------------------+
cpu_buffer->head_page
tail |
v v
+--> subbuf --HEAD--> subbuf ----> subbuf ----> subbuf ----> subbuf --+
| |
+---------------------------------------------------------------------+
Now, I'll break up the update part:
cpu_buffer->head_page
tail |
v v
+--> subbuf --UPDATE--> subbuf ----> subbuf ----> subbuf ----> subbuf --+
| |
+-----------------------------------------------------------------------+
cpu_buffer->head_page
tail |
v v
+--> subbuf --UPDATE--> subbuf --HEAD--> subbuf ----> subbuf ----> subbuf --+
| |
+---------------------------------------------------------------------------+
An interrupt comes in and moves the head even more.
cpu_buffer->head_page
tail |
v v
+--> subbuf --UPDATE--> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf --+
| |
+---------------------------------------------------------------------------+
Now the reader decides to read again and starts between the UPDATE and the HEAD
cpu_buffer->head_page
tail |
v v
+--> subbuf --UPDATE--> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf --+
| |
+---------------------------------------------------------------------------+
It finds a page with the HEAD pointer set but not the UPDATE pointer and does a swap!
reader_page -----+
|
cpu_buffer->head_page |
tail | |
v v v
+--> subbuf --UPDATE--> subbuf ----> subbuf ----> subbuf --HEAD--> subbuf --+
| |
+---------------------------------------------------------------------------+
Now the commit finishes and moves forward and will even hit a blank
page but the last write is now on the reader page. This breaks the
entire integrity of the ring buffer.
Does this make sense?
-- Steve
next prev parent reply other threads:[~2026-11-10 7:52 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-05 11:12 Breno Leitao
2026-11-05 20:57 ` Steven Rostedt
2026-11-09 7:21 ` Steven Rostedt
2026-11-09 9:21 ` Vincent Donnefort
2026-11-10 7:52 ` Steven Rostedt [this message]
2026-11-09 13:10 ` Breno Leitao
2026-11-10 7:55 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261110025202.78c8c03a@fedora \
--to=rostedt@goodmis.org \
--cc=kernel-team@meta.com \
--cc=leitao@debian.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=srostedt@redhat.com \
--cc=stable@vger.kernel.org \
--cc=vdonnefort@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®