[lkml]   [2012]   [Jan]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [tip:sched/core] sched: Fix ancient race in do_exit()
On 01/28, Linus Torvalds wrote:
> On Sat, Jan 28, 2012 at 4:03 AM, tip-bot for Yasunori Goto
> <> wrote:
> >
> > sched: Fix ancient race in do_exit()
> Ugh.
> It would be much nicer to just clear the rwsem waiter->task thing
> *after* waking the task up, which would avoid this race entirely,
> afaik.

How? The problem is that wake_up_process(tsk) sees this task in
TASK_UNINTERRUPTIBLE state (the first "p->state & state" check in
try_to_wake_up), but then this task changes its state to TASK_DEAD
without schedule() and ttwu() does s/TASK_DEAD/TASK_RUNNING/.

IOW, the task doing

current->state = TASK_A;
current->state = TASK_B;

can be woken up by try_to_wake_up(TASK_A), despite the fact it
sleeps in TASK_B. do_exit() is only "special" because it is not
easy to handle the spurious wakeup.

> Tell me, why wouldn't that work? rwsem_down_failed_common() does
> /* wait to be given the lock */
> for (;;) {
> if (!waiter.task)
> break;
> ...
> so then we wouldn't need the task refcount crap in rwsem either etc,
> and we'd get rid of all races with wakeup.
> I wonder why we're clearing that whole waiter->task so early.

I must have missed something. I can't understand how this can help,
and "clear the rwsem waiter->task thing *after* waking" looks
obviously wrong. If we do this, then we can miss the "!!waiter.task"
condition. The loop above actually does


if (!waiter.task)

waiter->task = NULL;

can happen right after set_task_state().


 \ /
  Last update: 2012-01-29 17:17    [W:0.088 / U:0.408 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site