From: Thomas Gleixner <tglx@linutronix.de>
To: Peter Zijlstra <peterz@infradead.org>
Cc: mingo@kernel.org, juri.lelli@arm.com, rostedt@goodmis.org,
xlpang@redhat.com, bigeasy@linutronix.de,
linux-kernel@vger.kernel.org, mathieu.desnoyers@efficios.com,
jdesfossez@efficios.com, bristot@redhat.com,
dvhart@infradead.org
Subject: Re: [PATCH -v5 10/14] futex: Pull rt_mutex_futex_unlock() out from under hb->lock
Date: Tue, 7 Mar 2017 15:08:17 +0100 (CET) [thread overview]
Message-ID: <alpine.DEB.2.20.1703071433190.3584@nanos> (raw)
In-Reply-To: <20170304093559.415341088@infradead.org>
On Sat, 4 Mar 2017, Peter Zijlstra wrote:
> @@ -1035,6 +1037,9 @@ static int attach_to_pi_state(u32 __user
> * has dropped the hb->lock in between queue_me() and unqueue_me_pi(),
> * which in turn means that futex_lock_pi() still has a reference on
> * our pi_state.
> + *
> + * IOW, we cannot race against the unlocked put_pi_state() in
> + * futex_unlock_pi().
That 'IOW' made my head spin for a while. I rather prefer to spell it out
more explicitely:
* The waiter holding a reference on @pi_state protects also
* against the unlocked put_pi_state() in futex_unlock_pi(),
* futex_lock_pi() and futex_wait_requeue_pi() as it cannot go to 0
* and consequentely free pi state before we can take a reference
* ourself.
> */
> WARN_ON(!atomic_read(&pi_state->refcount));
>
> @@ -1378,47 +1383,33 @@ static void mark_wake_futex(struct wake_
> smp_store_release(&q->lock_ptr, NULL);
> }
>
> -static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *top_waiter,
> - struct futex_hash_bucket *hb)
Please add a comment, that the caller must hold a reference on @pi_state
> +static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_state)
> {
> - struct task_struct *new_owner;
> - struct futex_pi_state *pi_state = top_waiter->pi_state;
> u32 uninitialized_var(curval), newval;
> + struct task_struct *new_owner;
> + bool deboost = false;
> DEFINE_WAKE_Q(wake_q);
> - bool deboost;
> int ret = 0;
>
> - if (!pi_state)
> - return -EINVAL;
> -
> - /*
> - * If current does not own the pi_state then the futex is
> - * inconsistent and user space fiddled with the futex value.
> - */
> - if (pi_state->owner != current)
> - return -EINVAL;
> -
> raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
> new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
> -
> - /*
> - * When we interleave with futex_lock_pi() where it does
> - * rt_mutex_timed_futex_lock(), we might observe @this futex_q waiter,
> - * but the rt_mutex's wait_list can be empty (either still, or again,
> - * depending on which side we land).
> - *
> - * When this happens, give up our locks and try again, giving the
> - * futex_lock_pi() instance time to complete and unqueue_me().
> - */
> if (!new_owner) {
> - raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
> - return -EAGAIN;
> + /*
> + * Since we held neither hb->lock nor wait_lock when coming
> + * into this function, we could have raced with futex_lock_pi()
> + * such that it will have removed the waiter that brought us
> + * here.
Hmm. That's not entirely correct. There are two cases:
lock_pi()
queue_me() <- Makes it visible as waiter in the hash bucket
unlock(hb->lock)
[1]
rtmutex_futex_lock()
[2]
lock(hb->lock)
Both [1] and [2] are valid reasons why the top waiter is not a rtmutex
waiter.
Thanks,
tglx
next prev parent reply other threads:[~2017-03-07 18:15 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-04 9:27 [PATCH -v5 00/14] the saga of FUTEX_UNLOCK_PI wobbles continues Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 01/14] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Peter Zijlstra
2017-03-14 20:48 ` [tip:locking/urgent] " tip-bot for Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 02/14] futex: Add missing error handling to FUTEX_REQUEUE_PI Peter Zijlstra
2017-03-14 20:49 ` [tip:locking/urgent] " tip-bot for Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 03/14] futex: Cleanup variable names for futex_top_waiter() Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 04/14] futex: Use smp_store_release() in mark_wake_futex() Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 05/14] futex: Remove rt_mutex_deadlock_account_*() Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 06/14] futex,rt_mutex: Provide futex specific rt_mutex API Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 07/14] futex: Change locking rules Peter Zijlstra
2017-03-07 13:22 ` Thomas Gleixner
2017-03-07 16:47 ` Sebastian Andrzej Siewior
2017-03-07 18:01 ` Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 08/14] futex: Cleanup refcounting Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 09/14] futex: Rework inconsistent rt_mutex/futex_q state Peter Zijlstra
2017-03-07 13:26 ` Thomas Gleixner
2017-03-04 9:27 ` [PATCH -v5 10/14] futex: Pull rt_mutex_futex_unlock() out from under hb->lock Peter Zijlstra
2017-03-07 14:08 ` Thomas Gleixner [this message]
2017-03-07 18:01 ` Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 11/14] futex,rt_mutex: Introduce rt_mutex_init_waiter() Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 12/14] futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock() Peter Zijlstra
2017-03-07 14:18 ` Thomas Gleixner
2017-03-07 17:57 ` Peter Zijlstra
2017-03-07 17:59 ` Thomas Gleixner
2017-03-08 15:29 ` [PATCH] futex: move debug_rt_mutex_free_waiter() further down Sebastian Andrzej Siewior
2017-03-08 15:37 ` Sebastian Andrzej Siewior
2017-03-08 16:21 ` Steven Rostedt
2017-03-08 16:20 ` Steven Rostedt
2017-03-13 9:16 ` Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 13/14] futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock() Peter Zijlstra
2017-03-04 9:27 ` [PATCH -v5 14/14] futex: futex_unlock_pi() determinism Peter Zijlstra
2017-03-07 14:31 ` Thomas Gleixner
2017-03-07 17:59 ` Peter Zijlstra
2017-03-13 9:25 ` Peter Zijlstra
2017-03-13 14:25 ` Thomas Gleixner
2017-03-13 15:11 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.20.1703071433190.3584@nanos \
--to=tglx@linutronix.de \
--cc=bigeasy@linutronix.de \
--cc=bristot@redhat.com \
--cc=dvhart@infradead.org \
--cc=jdesfossez@efficios.com \
--cc=juri.lelli@arm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=xlpang@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).