Message-ID: <c1a03870-43dd-5837-0a09-1ba3a996ec59@huaweicloud.com>
Date:   Mon, 23 Jan 2023 21:02:30 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.1
Subject: Re: [PATCH] Fix data race in mark_rt_mutex_waiters
To:     Alan Stern <stern@rowland.harvard.edu>,
        "Paul E. McKenney" <paulmck@kernel.org>
Cc:     Hernan Ponce de Leon <hernan.poncedeleon@huaweicloud.com>,
        Arjan van de Ven <arjan@linux.intel.com>,
        peterz@infradead.org, mingo@redhat.com, will@kernel.org,
        longman@redhat.com, boqun.feng@gmail.com, akpm@osdl.org,
        tglx@linutronix.de, joel@joelfernandes.org,
        diogo.behrens@huawei.com, jonas.oberhauser@huawei.com,
        linux-kernel@vger.kernel.org,
        Hernan Ponce de Leon <hernanl.leon@huawei.com>,
        stable@vger.kernel.org
References: <20230120135525.25561-1-hernan.poncedeleon@huaweicloud.com>
 <562c883b-b2c3-3a27-f045-97e7e3281e0b@linux.intel.com>
 <20230120155439.GI2948950@paulmck-ThinkPad-P17-Gen-1>
 <9a1c7959-4b8c-94df-a3e2-e69be72bfd7d@huaweicloud.com>
 <20230123164014.GN2948950@paulmck-ThinkPad-P17-Gen-1>
 <Y87FLV0dWSyQz3NZ@rowland.harvard.edu>
From:   Jonas Oberhauser <jonas.oberhauser@huaweicloud.com>
In-Reply-To: <Y87FLV0dWSyQz3NZ@rowland.harvard.edu>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 1/23/2023 6:34 PM, Alan Stern wrote:
> On Mon, Jan 23, 2023 at 08:40:14AM -0800, Paul E. McKenney wrote:
>> In the case, the value read is passed into cmpxchg_relaxed(), which
>> checks the value against memory.  In this case, as Arjan noted, the only
>> compiler-and-silicon difference between data_race() and READ_ONCE()
>> is that use of data_race() might allow the compiler to do things like
>> tear the load, thus forcing the occasional spurious cmpxchg_relaxed()
>> failure.
> Is it possible in theory for a torn load to cause a spurious
> cmpxchg_relaxed() success?  Or would that not matter here?

Note that in this example there are no memory accesses between the read 
and the CAS.
So if the cmpxchg succeeds, what you non-atomically read must be exactly 
the value that is read by the cmpxchg, and you could pretend that the 
torn read happened at the same time as the cmpxchg.

This "pretend" part requires that there are no other events in the 
middle, otherwise you could be violating some ordering constraint 
between those events and the torn reads. Otherwise you might get some 
issues. E.g., you might read a sequence count of 259 from reading the 
lower half when the count is 3 and the upper half when the count is 256, 
and then do the CAS when the sequence count is 259, so if you had two 
peeks at sequence-count-protected data between that read and the CAS you 
might see different states despite the CAS succeeding.

have fun, jonas