TFD_CANCEL_ON_SET race when making a wall clock

TFD_CANCEL_ON_SET race when making a wall clock

[Colin Walters]

Hi,

So I was recently making GNOME use the new timerfd TFD_CANCEL_ON_SET so
we get woken up when the system clock changes.  It works generally well,
except Ryan Lortie pointed out a race condition in my use of
timerfd_settime() that I think anyone using it to make a wall clock
display might not realize at first:

https://bugzilla.gnome.org/show_bug.cgi?id=655129#c36

For the link-averse, basically the system clock can move backwards
between when the process gets the current time, and computes the wakeup
(typically for the next minute).

I was able to work around it in userspace with this patch:
http://bugzilla-attachments.gnome.org/attachment.cgi?id=195252
But it's clearly not what I'd call beautiful.

I don't see a nice way to handle this in the kernel given the current
API, but maybe someone else does?

TFD_CANCEL_ON_SET isn't documented in man-pages at all right now...maybe
this is just a useful note for a future patch to
man-pages/man2/timerfd_create.2.

Re: TFD_CANCEL_ON_SET race when making a wall clock

[Thomas Gleixner]

On Fri, 2 Sep 2011, Colin Walters wrote:

> Hi,
> 
> So I was recently making GNOME use the new timerfd TFD_CANCEL_ON_SET so
> we get woken up when the system clock changes.  It works generally well,
> except Ryan Lortie pointed out a race condition in my use of
> timerfd_settime() that I think anyone using it to make a wall clock
> display might not realize at first:
> 
> https://bugzilla.gnome.org/show_bug.cgi?id=655129#c36
> 
> For the link-averse, basically the system clock can move backwards
> between when the process gets the current time, and computes the wakeup
> (typically for the next minute).
> 
> I was able to work around it in userspace with this patch:
> http://bugzilla-attachments.gnome.org/attachment.cgi?id=195252
> But it's clearly not what I'd call beautiful.
> 
> I don't see a nice way to handle this in the kernel given the current
> API, but maybe someone else does?
> 
> TFD_CANCEL_ON_SET isn't documented in man-pages at all right now...maybe
> this is just a useful note for a future patch to
> man-pages/man2/timerfd_create.2.

Well, the kernel can only handle the time was set scenario from the
point when timerfd_create() is called.

There is no way to handle:

   clock_gettime(a);
				clock_settime();
   timerfd_create();
   timerfd_settime(a + x);

And there wont be one ever. The guarantee is that _after_
timerfd_create() any modification to CLOCK_REALTIME in either
direction is causing a cancelation of the timer.

Thanks,

	tglx

Re: TFD_CANCEL_ON_SET race when making a wall clock

[Colin Walters]

Hi Thomas,

On Fri, 2011-09-02 at 17:00 +0200, Thomas Gleixner wrote:

> There is no way to handle:
> 
>    clock_gettime(a);
> 				clock_settime();
>    timerfd_create();
>    timerfd_settime(a + x);
> 
> And there wont be one ever. 

Well, you can see what I did in userspace - require the processes' idea
of the current time to be passed in, and check after calling
timerfd_settime() - did the clock go backwards?  Ok, treat the timerfd
source as ready.

If we wanted to avoid userspace having to do this, we *could* make a new
system call which also took the "expected current time".  But it's
probably not worth doing so given that the userspace workaround isn't
too difficult.

So, I think you confirmed what I'm saying, we should just document this
and move on.   Thanks!