LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Yi Wang <wang.yi59@zte.com.cn>
To: tglx@linutronix.de
Cc: mingo@redhat.com, peterz@infradead.org, dvhart@infradead.org,
	linux-kernel@vger.kernel.org, xue.zhihong@zte.com.cn,
	wang.yi59@zte.com.cn, jiang.xuexin@zte.com.cn,
	Yang Tao <yang.tao172@zte.com.cn>
Subject: [PATCH] Robust-futex wakes up the waiters will be missed
Date: Wed, 6 Nov 2019 11:23:02 +0800
Message-ID: <1573010582-35297-1-git-send-email-wang.yi59@zte.com.cn> (raw)

From: Yang Tao <yang.tao172@zte.com.cn>

We found two scenarios:
(1)When the owner of a mutex lock with robust attribute and no_pi
will release the lock and executes pthread_mutex_unlock(),it is
killed after setting mutex->__data.__lock = 0 and before wake
others. It will go through the robust process, but it will not wake
up watiers because mutex->__data.__lock = 0.

                OWNER

        pthread_mutex_unlock()
                |
                |
                V
        atomic_exchange_rel (&mutex->__data.__lock, 0)
                        <------------------------killed
            lll_futex_wake ()                   |
                                                |
                                                |(__lock = 0)
                                                |(enter kernel)
                                                |
                                                V
                                            do_exit()
                                            exit_mm()
                                          mm_release()
                                        exit_robust_list()
                                        handle_futex_death()
                                                |
                                                |(__lock = 0)
                                                |(uval = 0)
                                                |
                                                V
        if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
                return 0;<------wakes up waiters will be missed

(2) When a waiter wakes up and returns to the user space, it is
killed before getting the lock (before modifying
mutex->__data.__lock), and other waiters will not wake up.

        OWNER                         WAITER

   pthread_mutex_unlock()
                |
                |(__lock = 0)
                |
                V
         futex_wake()
                                fuet_wait()   //awaked
                                        |
                                        |
                                        |(enter userspace)
                                        |(__lock = 0)
                                        |
                                        V
                        oldval = mutex->__data.__lock
                                          <-----------------killed
    atomic_compare_and_exchange_val_acq (&mutex->__data.__lock,  |
                        id | assume_other_futex_waiters, 0)      |
                                                                 |
                                                                 |
                                                   (enter kernel)|
                                                                 |
                                                                 V
                                                         do_exit()
                                                        |
                                                        |
                                                        V
                                        handle_futex_death()
                                        |
                                        |(__lock = 0)
                                        |(uval = 0)
                                        |
                                        V
        if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
                return 0;<------wakes up waiters will be missed
So, in these scenarios, task will not wake up waiters

We found that when the task was killed in two scenarios,
task->robust_list->list_op_pending =&mutex->__data.__list.__next,
so we can do something.

We think that task should wake up once when the following conditions
are met:
        (1) task->robust_list->list_op_pending != NULL;
        (2) mutex->__data.__lock = 0;
        (3) no_pi
In some cases, this may lead to some redundant wakeups, which will
reduce the efficiency of the program, but it will not affectthe
program operation, and it is very rare to meet these three
conditions.

At the same time, we only wake up and do not set the died bit,
because mutex->__data.__lock = 0; mutex->__data.__owner = 0;
At this time, it can be seen that there is no owner,and the wake-up
process directly take the lock.

If the died bit is set, it may cause some misoperation. Such as a
waiter being killed when the owner is releasing the lock, it will
mark the lock with the died bit, which is not good.

We don't need to set "mutex->__data.__count"(in mutex structure),
which will not affect repeated lock holding.

Signed-off-by: Yang Tao <yang.tao172@zte.com.cn>
---
 kernel/futex.c | 41 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index bd18f60..8511dad 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3456,7 +3456,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
  * Process a futex-list entry, check whether it's owned by the
  * dying task, and do notification if so:
  */
-static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
+static int handle_futex_death(u32 __user *uaddr,
+			      struct task_struct *curr, int pi,
+			      bool pending)
 {
 	u32 uval, uninitialized_var(nval), mval;
 	int err;
@@ -3469,6 +3471,35 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int p
 	if (get_user(uval, uaddr))
 		return -1;
 
+	/*
+	 * When uval is 0, there may be waiters blocking on the lock:
+	 *
+	 * (1)When the owner of a mutex lock with robust attribute
+	 * and no_pi will release the lock and executes
+	 * pthread_mutex_unlock(),it is killed after setting
+	 * mutex->__data.__lock = 0 (uval = 0)and before wake others.
+	 * It will enter the robust process, but it will not wake up
+	 * watiers because uval = 0.
+	 *
+	 * (2) When a waiter wakes up and returns to the user space,
+	 * it is killed before getting the lock (before modifying
+	 * mutex->__data.__lock), and other waiters will not wake up
+	 * because uval = 0.
+	 *
+	 * We found that when the task was killed in two scenarios,
+	 * task->robust_list->list_op_pending != NULL. Therefore,
+	 * it can be judged that the task is killed when releasing
+	 * or acquiring the lock.
+	 *
+	 * We should wake up once when the following conditions are
+	 * met:
+	 *	1) task->robust_list->list_op_pending != NULL
+	 *	2) mutex->__data.__lock = 0 (uval = 0)
+	 *	3) no_pi
+	 */
+	if (pending && !pi && uval == 0)
+		futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY);
+
 	if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
 		return 0;
 
@@ -3590,7 +3621,7 @@ void exit_robust_list(struct task_struct *curr)
 		 */
 		if (entry != pending)
 			if (handle_futex_death((void __user *)entry + futex_offset,
-						curr, pi))
+						curr, pi, 0))
 				return;
 		if (rc)
 			return;
@@ -3607,7 +3638,7 @@ void exit_robust_list(struct task_struct *curr)
 
 	if (pending)
 		handle_futex_death((void __user *)pending + futex_offset,
-				   curr, pip);
+				   curr, pip, 1);
 }
 
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
@@ -3784,7 +3815,7 @@ void compat_exit_robust_list(struct task_struct *curr)
 		if (entry != pending) {
 			void __user *uaddr = futex_uaddr(entry, futex_offset);
 
-			if (handle_futex_death(uaddr, curr, pi))
+			if (handle_futex_death(uaddr, curr, pi, 0))
 				return;
 		}
 		if (rc)
@@ -3803,7 +3834,7 @@ void compat_exit_robust_list(struct task_struct *curr)
 	if (pending) {
 		void __user *uaddr = futex_uaddr(pending, futex_offset);
 
-		handle_futex_death(uaddr, curr, pip);
+		handle_futex_death(uaddr, curr, pip, 1);
 	}
 }
 
-- 
2.15.2


             reply index

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-06  3:23 Yi Wang [this message]
2019-11-06 19:02 ` Thomas Gleixner
2019-11-15 18:19 ` [tip: locking/core] futex: Prevent robust futex exit race tip-bot2 for Yang Tao
  -- strict thread matches above, loose matches on Subject: below --
2019-11-01  2:03 [PATCH] Robust-futex wakes up the waiters will be missed Yi Wang
2019-11-04  9:16 ` Peter Zijlstra

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1573010582-35297-1-git-send-email-wang.yi59@zte.com.cn \
    --to=wang.yi59@zte.com.cn \
    --cc=dvhart@infradead.org \
    --cc=jiang.xuexin@zte.com.cn \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=peterz@infradead.org \
    --cc=tglx@linutronix.de \
    --cc=xue.zhihong@zte.com.cn \
    --cc=yang.tao172@zte.com.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git