From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751633AbbJJGu3 (ORCPT ); Sat, 10 Oct 2015 02:50:29 -0400 Received: from mail-wi0-f179.google.com ([209.85.212.179]:33012 "EHLO mail-wi0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751587AbbJJGu0 (ORCPT ); Sat, 10 Oct 2015 02:50:26 -0400 Subject: Re: PROBLEM: Concurrency issue in sem_lock To: =?UTF-8?Q?Felix_H=c3=bcbner?= , linux-kernel@vger.kernel.org References: <561779AC.6080106@informatik.uni-bremen.de> Cc: bitbucket@online.de, riel@redhat.com, dbueso@suse.de, Andrew Morton From: Manfred Spraul Message-ID: <5618B52E.8070601@colorfullife.com> Date: Sat, 10 Oct 2015 08:50:22 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <561779AC.6080106@informatik.uni-bremen.de> Content-Type: multipart/mixed; boundary="------------070208030101040203030001" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is a multi-part message in MIME format. --------------070208030101040203030001 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi, On 10/09/2015 10:24 AM, Felix Hübner wrote: > Hi all, > > I have just reported a concurrency issue in the implementation of > sem_lock, see https://bugzilla.kernel.org/show_bug.cgi?id=105651 > > [...] > # P0 does spin_lock(&sem->lock); in line 336. > > spin_lock(&sem->lock); [...] > # P2 performs rest of semtimedop, increments complex_count and ends up > in line 1961 and starts to sleep. > > return -1; > } That is the problem: semtimedop() increments complex_count - thus sem_wait_array() returns without a spin_unlock_wait() loop - but P0 already owns spin_lock(&sem->lock). How do we want to fix it? - revert my patch (simplify code, but slower for one corner case) - add the missing sem_wait_array (more complex, but also better for complex semops). what do you think? (patch untested) -- Manfred --------------070208030101040203030001 Content-Type: text/x-patch; name="0001-ipc-sem.c-Alternative-for-fixing-Concurrency-bug.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename*0="0001-ipc-sem.c-Alternative-for-fixing-Concurrency-bug.patch" >>From 0ce84d118e2ee7ebc98ad4a8cfd23f04ad45115c Mon Sep 17 00:00:00 2001 From: Manfred Spraul Date: Sat, 10 Oct 2015 08:37:22 +0200 Subject: [PATCH] ipc/sem.c: Alternative for fixing Concurrency bug Two ideas for fixing the bug found by Felix: - Revert my initial patch. Problem: Significant slowdown for application that use large sem arrays and complex operations: Every semop() does a loop with spin_lock() on all semaphores. - Add another sem_wait_array() that catches operations that are in the middle of sem_lock(). What do you think? Is it worth to optimize for complex ops? Reported-by: felixh@informatik.uni-bremen.de Signed-off-by: Manfred Spraul --- ipc/sem.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ipc/sem.c b/ipc/sem.c index b471e5a..9a55cfb 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -1936,9 +1936,16 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops, list_add_tail(&queue.list, &curr->pending_const); } } else { - if (!sma->complex_count) + if (!sma->complex_count) { merge_queues(sma); + /* + * squeeze out any simple operations that are in the middle + * of sem_lock() + */ + sem_wait_array(sma); + } + if (alter) list_add_tail(&queue.list, &sma->pending_alter); else -- 2.4.3 --------------070208030101040203030001--