DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DAFA2219A7
Date: Thu, 15 Jun 2017 11:54:50 -0700 (PDT)
From: Stefano Stabellini <sstabellini@kernel.org>
To: Boris Ostrovsky <boris.ostrovsky@oracle.com>
cc: Stefano Stabellini <sstabellini@kernel.org>, xen-devel@lists.xen.org,
        linux-kernel@vger.kernel.org, jgross@suse.com,
        Stefano Stabellini <stefano@aporeto.com>
Subject: Re: [PATCH v3 06/18] xen/pvcalls: handle commands from the
 frontend
In-Reply-To: <7013dd41-d7a7-3ccd-0c44-d774e0065f43@oracle.com>
Message-ID: <alpine.DEB.2.10.1706151150540.12156@sstabellini-ThinkPad-X260>
References: <alpine.DEB.2.10.1706021225440.18759@sstabellini-ThinkPad-X260> <1496431915-20774-1-git-send-email-sstabellini@kernel.org> <1496431915-20774-6-git-send-email-sstabellini@kernel.org> <3f119021-c866-5138-fe4b-263befa377b2@oracle.com>
 <alpine.DEB.2.10.1706141342420.12156@sstabellini-ThinkPad-X260> <7013dd41-d7a7-3ccd-0c44-d774e0065f43@oracle.com>
User-Agent: Alpine 2.10 (DEB 1266 2009-07-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2774
Lines: 73

On Thu, 15 Jun 2017, Boris Ostrovsky wrote:
> On 06/14/2017 05:03 PM, Stefano Stabellini wrote:
> > On Mon, 12 Jun 2017, Boris Ostrovsky wrote:
> >>> +
> >>>  static void pvcalls_back_work(struct work_struct *work)
> >>>  {
> >>> +	struct pvcalls_fedata *priv = container_of(work,
> >>> +		struct pvcalls_fedata, register_work);
> >>> +	int notify, notify_all = 0, more = 1;
> >>> +	struct xen_pvcalls_request req;
> >>> +	struct xenbus_device *dev = priv->dev;
> >>> +
> >>> +	while (more) {
> >>> +		while (RING_HAS_UNCONSUMED_REQUESTS(&priv->ring)) {
> >>> +			RING_COPY_REQUEST(&priv->ring,
> >>> +					  priv->ring.req_cons++,
> >>> +					  &req);
> >>> +
> >>> +			if (!pvcalls_back_handle_cmd(dev, &req)) {
> >>> +				RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(
> >>> +					&priv->ring, notify);
> >>> +				notify_all += notify;
> >>> +			}
> >>> +		}
> >>> +
> >>> +		if (notify_all)
> >>> +			notify_remote_via_irq(priv->irq);
> >>> +
> >>> +		RING_FINAL_CHECK_FOR_REQUESTS(&priv->ring, more);
> >>> +	}
> >>>  }
> >>>  
> >>>  static irqreturn_t pvcalls_back_event(int irq, void *dev_id)
> >>>  {
> >>> +	struct xenbus_device *dev = dev_id;
> >>> +	struct pvcalls_fedata *priv = NULL;
> >>> +
> >>> +	if (dev == NULL)
> >>> +		return IRQ_HANDLED;
> >>> +
> >>> +	priv = dev_get_drvdata(&dev->dev);
> >>> +	if (priv == NULL)
> >>> +		return IRQ_HANDLED;
> >>> +
> >>> +	/*
> >>> +	 * TODO: a small theoretical race exists if we try to queue work
> >>> +	 * after pvcalls_back_work checked for final requests and before
> >>> +	 * it returns. The queuing will fail, and pvcalls_back_work
> >>> +	 * won't do the work because it is about to return. In that
> >>> +	 * case, we lose the notification.
> >>> +	 */
> >>> +	queue_work(priv->wq, &priv->register_work);
> >> Would queuing delayed work (if queue_work() failed) help? And canceling
> >> it on next invocation of pvcalls_back_event()?
> > Looking at the implementation of queue_delayed_work_on and
> > queue_work_on, it looks like that if queue_work fails then also
> > queue_delayed_work would fail: they both test on
> > WORK_STRUCT_PENDING_BIT.
> 
> Right, I should have looked at this myself. And flush_work() I suppose
> cannot be used here since it may sleep?
> 
> Then I also can't think of anything else.

I guess one way to work around the issue would be to use multiple work
items, and queue a new (different) work item at each pvcalls_back_event.
But that approach would use more memory and would need a new lock
in pvcalls_back_work.

Given that the race is only theoretical (I am running nginx inside a
VM and hitting it with as many multiple requests as I can and still I
cannot reproduce it), I am tempted to leave it as-is with a comment. We
can revisit it in the future if we find any real issues.