From: Vincent Donnefort <vdonnefort@google.com>
To: Steven Rostedt <rostedt@goodmis.org>
Cc: Breno Leitao <leitao@debian.org>,
Masami Hiramatsu <mhiramat@kernel.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org,
Steven Rostedt <srostedt@redhat.com>,
kernel-team@meta.com, stable@vger.kernel.org
Subject: Re: [PATCH v2] ring-buffer: Handle a reader taking the new head in rb_handle_head_page()
Date: Wed, 11 Nov 2026 13:32:13 +0000 [thread overview]
Message-ID: <avRuXVxVrp-Kjiqj@google.com> (raw)
In-Reply-To: <20261110025202.78c8c03a@fedora>
On Tue, Nov 10, 2026 at 02:52:02AM -0500, Steven Rostedt wrote:
> On Mon, 9 Nov 2026 09:21:32 +0000
> Vincent Donnefort <vdonnefort@google.com> wrote:
>
> > > The issue I think you hit was that we have two HEAD pages, when interrupts
> > > come in. That is, we can get a state of:
> > >
> > > --> subbuf --UPDATE--> subbuf --> subbuf --HEAD--> subbuf -->
> >
> > How we can end-up in this situation? The cmpxch will only swap HEAD for UPDATE.
>
> The cpu_buffer->head_page is only updated by the reader, when it did its last read.
>
> Let's look at it one at a time:
>
> cpu_buffer->head_page
> tail |
> v v
> +--> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf ----> subbuf --+
> | |
> +---------------------------------------------------------------------+
>
> Then the writer moves the HEAD page around the buffer while there are
> no reads happening
>
>
> cpu_buffer->head_page
> tail |
> v v
> +--> subbuf ----> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf --+
> | |
> +---------------------------------------------------------------------+
>
> cpu_buffer->head_page
> | tail
> v v
> +--> subbuf ----> subbuf ----> subbuf ----> subbuf --HEAD--> subbuf --+
> | |
> +---------------------------------------------------------------------+
>
> cpu_buffer->head_page
> | tail
> v v
> +-HEAD-> subbuf ----> subbuf ----> subbuf ----> subbuf ----> subbuf --+
> | |
> +---------------------------------------------------------------------+
>
> cpu_buffer->head_page
> tail |
> v v
> +--> subbuf --HEAD--> subbuf ----> subbuf ----> subbuf ----> subbuf --+
> | |
> +---------------------------------------------------------------------+
>
> Now, I'll break up the update part:
>
> cpu_buffer->head_page
> tail |
> v v
> +--> subbuf --UPDATE--> subbuf ----> subbuf ----> subbuf ----> subbuf --+
> | |
> +-----------------------------------------------------------------------+
>
> cpu_buffer->head_page
> tail |
> v v
> +--> subbuf --UPDATE--> subbuf --HEAD--> subbuf ----> subbuf ----> subbuf --+
> | |
> +---------------------------------------------------------------------------+
>
> An interrupt comes in and moves the head even more.
>
> cpu_buffer->head_page
> tail |
> v v
> +--> subbuf --UPDATE--> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf --+
> | |
> +---------------------------------------------------------------------------+
>
> Now the reader decides to read again and starts between the UPDATE and the HEAD
>
>
> cpu_buffer->head_page
> tail |
> v v
> +--> subbuf --UPDATE--> subbuf ----> subbuf --HEAD--> subbuf ----> subbuf --+
> | |
> +---------------------------------------------------------------------------+
>
> It finds a page with the HEAD pointer set but not the UPDATE pointer and does a swap!
>
>
> reader_page -----+
> |
> cpu_buffer->head_page |
> tail | |
> v v v
> +--> subbuf --UPDATE--> subbuf ----> subbuf ----> subbuf --HEAD--> subbuf --+
> | |
> +---------------------------------------------------------------------------+
>
> Now the commit finishes and moves forward and will even hit a blank
> page but the last write is now on the reader page. This breaks the
> entire integrity of the ring buffer.
>
> Does this make sense?
>
> -- Steve
Yes, now I spent more time on it, I believe it makes sense. I looked at what we
could do and I'm trying to use a temporary RB_PAGE_HEAD | RB_PAGE_UPDATE. This
link flag is then only converted to RB_PAGE_HEAD by the outer writer. I believe
this would fix the race entirely... However that means the reader spins as long
as the buffer writing is interrupted, which I admit is far from ideal.
--
Vincent
next prev parent reply other threads:[~2026-11-11 13:32 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-05 11:12 Breno Leitao
2026-11-05 20:57 ` Steven Rostedt
2026-11-09 7:21 ` Steven Rostedt
2026-11-09 9:21 ` Vincent Donnefort
2026-11-10 7:52 ` Steven Rostedt
2026-11-11 13:32 ` Vincent Donnefort [this message]
2026-11-09 13:10 ` Breno Leitao
2026-11-10 7:55 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avRuXVxVrp-Kjiqj@google.com \
--to=vdonnefort@google.com \
--cc=kernel-team@meta.com \
--cc=leitao@debian.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=rostedt@goodmis.org \
--cc=srostedt@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®