Messages in this thread | | | Date | Tue, 9 Dec 2014 12:35:56 +0100 | From | David Hildenbrand <> | Subject | Re: [PATCH v2] CPU hotplug: active_writer not woken up in some cases - deadlock |
| |
> On Tue, Dec 09, 2014 at 11:11:01AM +0100, David Hildenbrand wrote: > > > > Therefore we have to move the condition check inside the > > > > __set_current_state(TASK_UNINTERRUPTIBLE) -> schedule(); > > > > section to not miss any wake ups when the condition is satisfied. > > > > > > > > So wake_up_process() will either see TASK_RUNNING and do nothing or see > > > > TASK_UNINTERRUPTIBLE and set it to TASK_RUNNING, so schedule() will in > > > > fact be woken up again. > > > > > > Or the third alternative would be that 'active_writer' which was running > > > on CPU2 already terminated and wake_up_process() has a non-NULL pointer to > > > task_struct which is already dead. > > > Or is there anything that prevents this use-after-free race? > > > > Hmmm ... I think that is also a valid scenario. > > That would mean we need soemthing like this: > > > > void put_online_cpus(void) > > { > > + struct task_struct *awr; > > + > > if (cpu_hotplug.active_writer == current) > > return; > > if (!mutex_trylock(&cpu_hotplug.lock)) { > > + awr = ACCESS_ONCE(cpu_hotplug.active_writer); > > + if (unlikely(awr)) > > + get_task_struct(awr); > > How would this solve the problem?
Although this might fix the problem you addressed, it exposes another one:
CPU1 CPU2 ---------------------------------------------------------------------------- !mutex_trylock(&cpu_hotplug.lock) | cpu_hotplug.active_writer == 0 | awr = 0; | | cpu_hotplug.active_writer = current | __set_current_state(TASK_UNINTERRUPTIBLE); | cpu_hotplug.puts_pending == 0 cpu_hotplug.puts_pending++; | ... | schedule(); /* no wakeup as awr == 0 */
So we really need to cpu_hotplug.puts_pending++; before checking for cpu_hotplug.active_writer. That in turn can lead to the active_writer struct vanishing.
So we can't get around a lock for cpu_hotplug.active_writer IMHO. Or we have to revert the original patch - but that one addressed an rcu problem.
Opinions?
David
| |