Messages in this thread | | | Date | Tue, 9 Dec 2014 11:11:01 +0100 | From | David Hildenbrand <> | Subject | Re: [PATCH v2] CPU hotplug: active_writer not woken up in some cases - deadlock |
| |
> > Therefore we have to move the condition check inside the > > __set_current_state(TASK_UNINTERRUPTIBLE) -> schedule(); > > section to not miss any wake ups when the condition is satisfied. > > > > So wake_up_process() will either see TASK_RUNNING and do nothing or see > > TASK_UNINTERRUPTIBLE and set it to TASK_RUNNING, so schedule() will in > > fact be woken up again. > > Or the third alternative would be that 'active_writer' which was running > on CPU2 already terminated and wake_up_process() has a non-NULL pointer to > task_struct which is already dead. > Or is there anything that prevents this use-after-free race?
Hmmm ... I think that is also a valid scenario. That would mean we need soemthing like this:
void put_online_cpus(void) { + struct task_struct *awr; + if (cpu_hotplug.active_writer == current) return; if (!mutex_trylock(&cpu_hotplug.lock)) { + awr = ACCESS_ONCE(cpu_hotplug.active_writer); + if (unlikely(awr)) + get_task_struct(awr); + /* inc after get_task_struct(), so the writer can't get NULL */ atomic_inc(&cpu_hotplug.puts_pending); + /* we might be the last one */ + if (unlikely(awr)) { + wake_up_process(awr); + put_task_struct(awr); + } cpuhp_lock_release(); return; }
Thanks!
David
| |