Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20200211040651.1993-1-cai@lca.pw>
In-Reply-To: <20200211040651.1993-1-cai@lca.pw>
From:   Marco Elver <elver@google.com>
Date:   Tue, 11 Feb 2020 11:16:05 +0100
Message-ID: <CANpmjNPWCu+w3O8cg++X4=viVFsWNehTXzTuqbwV8-DcXXpFng@mail.gmail.com>
Subject: Re: [PATCH -next] locking/osq_lock: annotate a data race in osq_lock
To:     Qian Cai <cai@lca.pw>
Cc:     Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@redhat.com>, Will Deacon <will@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, 11 Feb 2020 at 05:07, Qian Cai <cai@lca.pw> wrote:
>
> prev->next could be accessed concurrently as noticed by KCSAN,
>
>  write (marked) to 0xffff9d3370dbbe40 of 8 bytes by task 3294 on cpu 107:
>   osq_lock+0x25f/0x350
>   osq_wait_next at kernel/locking/osq_lock.c:79
>   (inlined by) osq_lock at kernel/locking/osq_lock.c:185
>   rwsem_optimistic_spin
>   <snip>
>
>  read to 0xffff9d3370dbbe40 of 8 bytes by task 3398 on cpu 100:
>   osq_lock+0x196/0x350
>   osq_lock at kernel/locking/osq_lock.c:157
>   rwsem_optimistic_spin
>   <snip>
>
> Since the write only stores NULL to prev->next and the read tests if
> prev->next equals to this_cpu_ptr(&osq_node). Even if the value is
> shattered, the code is still working correctly. Thus, mark it as an
> intentional data race using the data_race() macro.

I have said this before: we're not just guarding against load/store
tearing, although on their own, they make it deceptively easy to
reason about data races.

The case here seems to be another instance of a C-CAS, to avoid
unnecessarily dirtying a cacheline.

Here, the loop would make me suspicious, because a compiler could
optimize out re-loading the value. Due to the smp_load_acquire,
however, at the least we have 1 implied compiler barrier in this loop
which means that will likely not happen.

Before jumping to 'data_race()', I would ask again: how bad is the
READ_ONCE? Is the generated code the same? If so, just use the
READ_ONCE. Do you want to reason about all compiler optimizations? For
this code here, I certainly don't want to.

But in the end it's up to what maintainers prefer, and maybe there is
a very compelling argument that I missed that makes the fact this is a
data race always safe.

Thanks,
-- Marco

> Signed-off-by: Qian Cai <cai@lca.pw>
> ---
>  kernel/locking/osq_lock.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c
> index 1f7734949ac8..3c44ddbc11ce 100644
> --- a/kernel/locking/osq_lock.c
> +++ b/kernel/locking/osq_lock.c
> @@ -154,7 +154,7 @@ bool osq_lock(struct optimistic_spin_queue *lock)
>          */
>
>         for (;;) {
> -               if (prev->next == node &&
> +               if (data_race(prev->next == node) &&
>                     cmpxchg(&prev->next, node, NULL) == node)
>                         break;
>
> --
> 2.21.0 (Apple Git-122.2)
>