Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030830AbbD1Qnq (ORCPT ); Tue, 28 Apr 2015 12:43:46 -0400 Received: from casper.infradead.org ([85.118.1.10]:53964 "EHLO casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1030338AbbD1Qnm (ORCPT ); Tue, 28 Apr 2015 12:43:42 -0400 Date: Tue, 28 Apr 2015 18:43:29 +0200 From: Peter Zijlstra To: Davidlohr Bueso Cc: Thomas Gleixner , Sebastian Andrzej Siewior , Manfred Spraul , LKML , Ingo Molnar , Darren Hart , Steven Rostedt , fredrik.markstrom@windriver.com, "Paul E. McKenney" Subject: Re: [PATCH v2] ipc/mqueue: remove STATE_PENDING Message-ID: <20150428164329.GK5029@twins.programming.kicks-ass.net> References: <1428419030-20030-1-git-send-email-bigeasy@linutronix.de> <1428419030-20030-4-git-send-email-bigeasy@linutronix.de> <55241851.7060704@colorfullife.com> <20150410143726.GD3057@linutronix.de> <1430191493.2050.3.camel@stgolabs.net> <20150428123738.GY23123@twins.programming.kicks-ass.net> <1430239010.2004.6.camel@stgolabs.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1430239010.2004.6.camel@stgolabs.net> User-Agent: Mutt/1.5.21 (2012-12-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1952 Lines: 41 On Tue, Apr 28, 2015 at 09:36:50AM -0700, Davidlohr Bueso wrote: > On Tue, 2015-04-28 at 14:37 +0200, Peter Zijlstra wrote: > > On Mon, Apr 27, 2015 at 08:24:53PM -0700, Davidlohr Bueso wrote: > > > +static inline void pipelined_send(struct wake_q_head *wake_q, > > > + struct mqueue_inode_info *info, > > > struct msg_msg *message, > > > struct ext_wait_queue *receiver) > > > { > > > receiver->msg = message; > > > list_del(&receiver->list); > > > + wake_q_add(wake_q, receiver->task); > > > + /* > > > + * Ensure that updating receiver->state is the last > > > + * write operation: As once set, the receiver can continue, > > > + * and if we don't have the reference count from the wake_q, > > > + * yet, at that point we can later have a use-after-free > > > + * condition and bogus wakeup. > > > + */ > > > + smp_wmb(); /* pairs with smp_rmb() in wq_sleep */ > > > > You have this barrier because we cannot rely on a failed cmpxchg() > > actually being a full barrier, right? > > Failed cmpxchg() calls implies that the task is never added to the queue > (duplicate, which I cannot see occurring in this patch), so nothing > wrong with the bogus wakeups mentioned in the comment. > > This barrier is not added by this patch though. Currently we have it > serializing with the wake_up_process() with STATE_READY, for similar > reasons. Because there is no task refcounting going on, the task can > easily disappear underneath us if the state is set before the wakeup. I > applied the same judgment here. Well, if you can 'guarantee' the cmpxchg will not fail, you can then rely on the fact that cmpxchg implies a full barrier, which would obviate the need for the wmb. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/