From: "Paul E. McKenney" <paulmck@kernel.org>
To: peterz@infradead.org, mingo@redhat.com, will@kernel.org
Cc: linux-kernel@vger.kernel.org
Subject: Question on task_blocks_on_rt_mutex()
Date: Mon, 31 Aug 2020 15:49:11 -0700 [thread overview]
Message-ID: <20200831224911.GA13114@paulmck-ThinkPad-P72> (raw)
Hello!
The task_blocks_on_rt_mutex() function uses rt_mutex_owner() to
take a snapshot of the lock owner right up front. At this point,
the ->wait_lock is held, which at first glance prevents the owner
from leaving. Except that if there are not yet any waiters (that is,
the low-order bit of ->owner is zero), rt_mutex_fastunlock() might
locklessly clear the ->owner field. And in that case, it looks like
task_blocks_on_rt_mutex() will blithely continue using the ex-owner's
task_struct structure, without anything that I can see that prevents
the ex-owner from exiting.
What am I missing here?
The reason that I am looking into this is that locktorture scenario LOCK05
hangs, and does so leaving the torture_rtmutex.waiters field equal to 0x1.
This is of course a legal transitional state, but I would not expect it
to persist for more than three minutes. Yet it often does.
This leads me to believe that there is a way for an unlock to fail to wake
up a task concurrently acquiring the lock. This seems to be repaired
by later lock acquisitions, and in fact setting the locktorture.stutter
module parameter to zero avoids the hang. Except that I first found the
above apparently unprotected access to what was recently the owner task.
Thoughts?
Thanx, Paul
next reply other threads:[~2020-08-31 22:49 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-31 22:49 Paul E. McKenney [this message]
2020-08-31 23:21 ` Question on task_blocks_on_rt_mutex() Paul E. McKenney
2020-09-01 17:49 ` Paul E. McKenney
2020-09-01 23:58 ` Paul E. McKenney
2020-09-02 1:51 ` Davidlohr Bueso
2020-09-02 15:54 ` Paul E. McKenney
2020-09-03 20:06 ` Paul E. McKenney
2020-09-04 17:24 ` Davidlohr Bueso
2020-09-04 19:56 ` Paul E. McKenney
2020-09-05 21:24 ` Joel Fernandes
2020-09-05 21:45 ` Joel Fernandes
2020-09-06 4:14 ` Paul E. McKenney
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200831224911.GA13114@paulmck-ThinkPad-P72 \
--to=paulmck@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).