From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Galbraith Subject: Re: 2.6.33.[56]-rt23: howto create repeatable explosion in wakeup_next_waiter() Date: Fri, 09 Jul 2010 10:13:50 +0200 Message-ID: <1278663230.10134.15.camel@marge.simson.net> References: <1278478019.10245.77.camel@marge.simson.net> <4C368565.3020806@us.ibm.com> <4C36CD83.6070809@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Cc: Thomas Gleixner , linux-rt-users , Peter Zijlstra , Steven Rostedt , gowrishankar To: Darren Hart Return-path: Received: from mail.gmx.net ([213.165.64.20]:36743 "HELO mail.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1754512Ab0GIINn (ORCPT ); Fri, 9 Jul 2010 04:13:43 -0400 In-Reply-To: <4C36CD83.6070809@us.ibm.com> Sender: linux-rt-users-owner@vger.kernel.org List-ID: On Fri, 2010-07-09 at 00:19 -0700, Darren Hart wrote: > I'll keep on looking, but I wanted to share what I've learned in case anyone > in another timezone is hoping to continue debugging should I fall asleep at > the helm ;-) Still making smoke here, no heat or light tho.. Q: why is it ok to call rt_mutex_proxy_unlock() without the wait_lock held? Every other path leading to rt_mutex_set_owner() seems to hold the lock. Locking it did diddly spit other than shut up my WARN_ON(). diff --git a/kernel/futex.c b/kernel/futex.c index a6cec32..f4b76d9 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -407,7 +407,9 @@ static void free_pi_state(struct futex_pi_state *pi_state) list_del_init(&pi_state->list); raw_spin_unlock_irq(&pi_state->owner->pi_lock); + raw_spin_lock(&pi_state->pi_mutex.wait_lock); rt_mutex_proxy_unlock(&pi_state->pi_mutex, pi_state->owner); + raw_spin_unlock(&pi_state->pi_mutex.wait_lock); } if (current->pi_state_cache)