Message-ID: <4122ef0d-1508-8ce2-df80-874565a612ce@redhat.com>
Date:   Thu, 26 Jan 2023 20:46:45 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: [PATCH] Fix data race in mark_rt_mutex_waiters
Content-Language: en-US
To:     David Laight <David.Laight@ACULAB.COM>,
        'Hernan Ponce de Leon' <hernan.poncedeleon@huaweicloud.com>,
        Peter Zijlstra <peterz@infradead.org>
Cc:     "paulmck@kernel.org" <paulmck@kernel.org>,
        Arjan van de Ven <arjan@linux.intel.com>,
        "mingo@redhat.com" <mingo@redhat.com>,
        "will@kernel.org" <will@kernel.org>,
        "boqun.feng@gmail.com" <boqun.feng@gmail.com>,
        "akpm@osdl.org" <akpm@osdl.org>,
        "tglx@linutronix.de" <tglx@linutronix.de>,
        "joel@joelfernandes.org" <joel@joelfernandes.org>,
        "stern@rowland.harvard.edu" <stern@rowland.harvard.edu>,
        "diogo.behrens@huawei.com" <diogo.behrens@huawei.com>,
        "jonas.oberhauser@huawei.com" <jonas.oberhauser@huawei.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Hernan Ponce de Leon <hernanl.leon@huawei.com>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>,
        Jonas Oberhauser <jonas.oberhauser@huaweicloud.com>
References: <20230120135525.25561-1-hernan.poncedeleon@huaweicloud.com>
 <562c883b-b2c3-3a27-f045-97e7e3281e0b@linux.intel.com>
 <20230120155439.GI2948950@paulmck-ThinkPad-P17-Gen-1>
 <9a1c7959-4b8c-94df-a3e2-e69be72bfd7d@huaweicloud.com>
 <20230123164014.GN2948950@paulmck-ThinkPad-P17-Gen-1>
 <f17dcce0-d510-a112-3127-984e8e73f480@huaweicloud.com>
 <d1e28124-b7a7-ae19-87ec-b1dcd3701b61@redhat.com>
 <Y8/+2YBRD4rFySjh@hirez.programming.kicks-ass.net>
 <ae90e931-df19-9d60-610c-57dc34494d8e@redhat.com>
 <c300747a-cf81-0e2d-77ec-f861421291f9@huaweicloud.com>
 <Y9Jv9yL8x7/TAq/X@hirez.programming.kicks-ass.net>
 <9da70674-42e0-9aaa-edab-c606ca8dd2e8@huaweicloud.com>
 <004045af7a2b4abaa5f4d9840371da60@AcuMS.aculab.com>
From:   Waiman Long <longman@redhat.com>
In-Reply-To: <004045af7a2b4abaa5f4d9840371da60@AcuMS.aculab.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 1/26/23 17:10, David Laight wrote:
> From: Hernan Ponce de Leon
>> Sent: 26 January 2023 21:07
> ...
>>    static __always_inline void rt_mutex_clear_owner(struct rt_mutex_base
>> *lock)
>> @@ -232,12 +232,7 @@ static __always_inline bool
>> rt_mutex_cmpxchg_release(struct rt_mutex_base *lock,
>>     */
>>    static __always_inline void mark_rt_mutex_waiters(struct rt_mutex_base
>> *lock)
>>    {
>> -	unsigned long owner, *p = (unsigned long *) &lock->owner;
>> -
>> -	do {
>> -		owner = *p;
>> -	} while (cmpxchg_relaxed(p, owner,
>> -				 owner | RT_MUTEX_HAS_WAITERS) != owner);
>> +	atomic_long_or(RT_MUTEX_HAS_WAITERS, (atomic_long_t *)&lock->owner);
> These *(int_type *)&foo accesses (quite often just plain wrong)
> made me look up the definitions.
>
> All one big accident waiting to happen...
> RT_MUTEX_HAS_WAITERS is defined in a different header to the structure.
> The explanatory comment is in a 3rd file.
>
> It would all be safer if lock->owner were atomic_long_t with a comment
> that it was the waiting task_struct | RT_MUTEX_HAS_WAITERS.
>
> Given the actual definition is rt_mutex_base_is_locked() even correct?

It is arguable if it should be considered locked if a waiter is waiting 
but the lock is at an unlock state at the moment. Mutex has a narrower 
definition of locked while others have a broader one.

Cheers,
Longman