From: luferry <[email protected]>
The race can reproduced by sending wait enabled IPI in softirq/irq env
src cpu only send ipi when dst cpu with queue empty, if interrupts
disturbed between llist_add and send_ipi. Interrupt handler may raise
softirq.In irq env, if src cpu try send_ipi to same dst cpu with
wait enabled. Since dst cpu's queue is not empty, src cpu won't send
ipi and dst cpu won't be waked up. src cpu will stall in
csd_lock_wait(csd). Which may cause soft lockup or hard lockup depends on
which time other cpus do send IPI to dst cpu.
So just send IPI when wait enabled and in_interrupt()
if (llist_add(&csd->llist, &per_cpu(call_single_queue, cpu)))
// src cpu got interrupt here
arch_send_call_function_single_ipi(cpu);
CPU0 CPU1
kernel env:smp_call_function call_single_queue empty
kernel env:llist_add
call_single_queue got csd
get interrupt
raise softirq
irq env:smp_call_function with wait
irq env:llist_add
irq env:queue not empty and skip send ipi
irq env:waiting for csd execution
Signed-off-by: luferry <[email protected]>
---
kernel/smp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/smp.c b/kernel/smp.c
index d155374632eb..de31a49b9fa7 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -142,9 +142,8 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(call_single_data_t, csd_data);
static int generic_exec_single(int cpu, call_single_data_t *csd,
smp_call_func_t func, void *info)
{
+ unsigned long flags;
if (cpu == smp_processor_id()) {
- unsigned long flags;
-
/*
* We can unlock early even for the synchronous on-stack case,
* since we're doing this from the same CPU..
@@ -176,8 +175,10 @@ static int generic_exec_single(int cpu, call_single_data_t *csd,
* locking and barrier primitives. Generic code isn't really
* equipped to do the right thing...
*/
+ local_irq_save(flags);
if (llist_add(&csd->llist, &per_cpu(call_single_queue, cpu)))
arch_send_call_function_single_ipi(cpu);
+ local_irq_restore(flags);
return 0;
}
--
2.14.1.40.g8e62ba1