lkml.org 
[lkml]   [2009]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [GIT pull] genirq fixes for 2.6.31


On Thu, 13 Aug 2009, Thomas Gleixner wrote:

> On Thu, 13 Aug 2009, Linus Torvalds wrote:
> > Now, I can see a bug, which is that "action->tsk" may have been set to
> > NULL. But I can't see a race, and I can't see a reason for all the code
> > movement. So quite frankly, I think the comments (both in the code and in
> > the commit message) are just wrong. And the odd "load it first, then do
> > other things" code looks confused.
> >
> > So why is this not just a
> >
> > if (action->thread)
> > wake_up_process(action->thread);
> >
> > with appropriate comments?
>
> What guarantees that the compiler does not dereference action->thread
> twice and the action->thread = NULL; operation happens between the
> check and the wake_up_process() call? I might be paranoid, but ...

Aren't we holding the lock here?

And if we are _not_ holding the lock, then it's racy anyway, and the right
fix is the other one I suggested:

> > Or, alternatively, just move all the "clear action->thread" in free_irq()
> > to after having done the "synchronize_irq()" thing, and then - afaik -
> > you'll not need that test at all, because you're guaranteed that as long
> > as you're in an interrupt handler, the thing shouldn't be cleared.
>
> Right, I looked at that as well, but we need to do it different than
> just calling synchronize_irq(), as we need to keep desc->lock after we
> established that no interrupt is in progress. Otherwise we can run
> into the same problem which we have right now. Patch below.

But we already _do_ call synchronize_irq().

And no, we'd better not be running into the same problem, becaue dang it,
if we do, then 'action' itself is unreliable (since we'll be doing a
'kfree()' in it in free_irq())

IOW, why not just make the patch do something like the appended?

NOTE! This is UNTESTED. And I also - on purpose - removed the "set
action->thread to NULL", because we're going to free 'action', so if
anything depends on it, it's already buggy.

What am I missing?

Linus

---
kernel/irq/manage.c | 17 ++++++++---------
1 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 61c679d..0747f22 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -809,9 +809,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
desc->chip->disable(irq);
}

- irqthread = action->thread;
- action->thread = NULL;
-
spin_unlock_irqrestore(&desc->lock, flags);

unregister_handler_proc(irq, action);
@@ -819,12 +816,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
/* Make sure it's not being used on another CPU: */
synchronize_irq(irq);

- if (irqthread) {
- if (!test_bit(IRQTF_DIED, &action->thread_flags))
- kthread_stop(irqthread);
- put_task_struct(irqthread);
- }
-
#ifdef CONFIG_DEBUG_SHIRQ
/*
* It's a shared IRQ -- the driver ought to be prepared for an IRQ
@@ -840,6 +831,14 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
local_irq_restore(flags);
}
#endif
+
+ irqthread = action->thread;
+ if (irqthread) {
+ if (!test_bit(IRQTF_DIED, &action->thread_flags))
+ kthread_stop(irqthread);
+ put_task_struct(irqthread);
+ }
+
return action;
}


\
 
 \ /
  Last update: 2009-10-18 23:28    [W:0.071 / U:0.884 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site