From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4DB70ED9; Thu, 7 Mar 2024 00:04:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709769869; cv=none; b=amg43NfiqVB0rdCsWLlj694/xfqxFFDKeczMQ5uPWl2/5mVoq7ZzcLueaJu9NQHdNXRrdMqvqO736Vx5K1vydadCeJ4+qJjh6+ao6xlZ5eDQ1oz4INlmakB0NDslhGLsj+SpUnQUqUw0PzWHD7V5TneK1G9zKxcFAvfqbz5/XVA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709769869; c=relaxed/simple; bh=+W6hvbt5EEqgiR4S3fDu1Rhs7u+YAG3HxUAFWBzgCCM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=HsqZJCjGVoNfuTlF3HxKOHRyK/NNBVwawFRPwyALQhW2lTC5ZvbVLKldRhuhsfU2h+wrtBu7eUJPgdEocKL62lL3Uy8yZyFhu7/e6fdkGaRyUuHrIIbXFCN6GwD/8nzcZMPJEPCk5KdWvtCiRxXVmw2eXx/yiFI6MUb+zSVGQoY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dbo5OexW; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dbo5OexW" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C22CC433F1; Thu, 7 Mar 2024 00:04:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1709769868; bh=+W6hvbt5EEqgiR4S3fDu1Rhs7u+YAG3HxUAFWBzgCCM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=dbo5OexWpCB8imBP66fHNUASvxTRfjAx4U8M8fWzj27f3+XmVZl4hz4YKkc53LTfC qpFrRWIYcqwIqay8iLEUrBcwpsK5plXqYDXwooxAHwVMHaA0L5scKaBebz5gKlU6YU cNFgWstKzKNBtfZ3sJCJJslNJxQSUW3gr595ohaNAfDubD2l5WpDws6aV/NnkUpbKa ieCtvdPvmuEOL7J4GRFAvoMT6rQewoQsG4z4peIzGIT+wcpqmNrvlqxN/9cb7Sw3Kk Mp0RQl0zh0U+D9mFw19qiZmrUUpkhyChPhDVam4UEw2cKtSvOTpIsKg7HLq2BaUYZj SzcZsUcHDyg6g== Date: Thu, 7 Mar 2024 01:04:25 +0100 From: Frederic Weisbecker To: "Uladzislau Rezki (Sony)" Cc: "Paul E . McKenney" , RCU , Neeraj upadhyay , Boqun Feng , Hillf Danton , Joel Fernandes , LKML , Oleksiy Avramchenko Subject: Re: [PATCH 1/2] rcu: Do not release a wait-head from a GP kthread Message-ID: References: <20240305195720.42687-1-urezki@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20240305195720.42687-1-urezki@gmail.com> Le Tue, Mar 05, 2024 at 08:57:19PM +0100, Uladzislau Rezki (Sony) a écrit : > Fix a below race by not releasing a wait-head from the > GP-kthread as it can lead for reusing it whereas a worker > can still access it thus execute newly added callbacks too > early. > > CPU 0 CPU 1 > ----- ----- > > // wait_tail == HEAD1 > rcu_sr_normal_gp_cleanup() { > // has passed SR_MAX_USERS_WAKE_FROM_GP > wait_tail->next = next; > // done_tail = HEAD1 > smp_store_release(&rcu_state.srs_done_tail, wait_tail); > queue_work() { > test_and_set_bit(WORK_STRUCT_PENDING_BIT, work_data_bits(work) > __queue_work() > } > } > > set_work_pool_and_clear_pending() > rcu_sr_normal_gp_cleanup_work() { > // new GP, wait_tail == HEAD2 > rcu_sr_normal_gp_cleanup() { > // executes all completion, but stop at HEAD1 > wait_tail->next = HEAD1; > // done_tail = HEAD2 > smp_store_release(&rcu_state.srs_done_tail, wait_tail); > queue_work() { > test_and_set_bit(WORK_STRUCT_PENDING_BIT, work_data_bits(work) > __queue_work() > } > } > // done = HEAD2 > done = smp_load_acquire(&rcu_state.srs_done_tail); > // head = HEAD1 > head = done->next; > done->next = NULL; > llist_for_each_safe() { > // completes all callbacks, release HEAD1 > } > } > // Process second queue > set_work_pool_and_clear_pending() > rcu_sr_normal_gp_cleanup_work() { > // done = HEAD2 > done = smp_load_acquire(&rcu_state.srs_done_tail); > > // new GP, wait_tail == HEAD3 > rcu_sr_normal_gp_cleanup() { > // Finds HEAD2 with ->next == NULL at the end > rcu_sr_put_wait_head(HEAD2) > ... > > // A few more GPs later > rcu_sr_normal_gp_init() { > HEAD2 = rcu_sr_get_wait_head(); > llist_add(HEAD2, &rcu_state.srs_next); > // head == rcu_state.srs_next > head = done->next; > done->next = NULL; > llist_for_each_safe() { > // EXECUTE CALLBACKS TOO EARLY!!! > } > } > > Reported-by: Frederic Weisbecker > Fixes: 05a10b921000 ("rcu: Support direct wake-up of synchronize_rcu() users") > Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Frederic Weisbecker