linux-kernel - Re: [RFC v4] wait: prevent waiter starvation in __wait_on_bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 23 Jan 2009 12:05:00 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Dmitry Adamushko <dmitry.adamushko@...il.com>
Cc:	Johannes Weiner <hannes@...xchg.org>,
	Chris Mason <chris.mason@...cle.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Matthew Wilcox <matthew@....cx>,
	Chuck Lever <cel@...i.umich.edu>,
	Nick Piggin <nickpiggin@...oo.com.au>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	Ingo Molnar <mingo@...e.hu>
Subject: Re: [RFC v4] wait: prevent waiter starvation in __wait_on_bit_lock

On 01/23, Dmitry Adamushko wrote:
>
> 2009/1/23 Oleg Nesterov <oleg@...hat.com>:
> > On 01/23, Dmitry Adamushko wrote:
> >>
> >> In short, wq->lock is a sync. mechanism in this case. The scheme is as follows:
> >>
> >> our side:
> >>
> >> [ finish_wait() ]
> >>
> >> lock(wq->lock);
> >
> > But we can skip lock(wq->lock), afaics.
> >
> > Without rmb(), test_bit() can be re-ordered with list_empty_careful()
> > in finish_wait() and even with __set_task_state(TASK_RUNNING).
>
> But taking into account the constraints of this special case, namely
> (1), we can't skip lock(wq->lock).
>
> (1) "the next contender is us"
>
> In this particular situation, we are only interested in the case when
> we were woken up by __wake_up_bit().

Yes,

> that means we are _on_ the 'wq' list when we do finish_wait() -> we do
> take the 'wq->lock'.

Hmm. No?

We are doing exclusive wait, and we use autoremove_wake_function().
If we were woken, we are removed from ->task_list.

> Moreover, imagine the following case (roughly similar to finish_wait()):
>
> if (LOAD(a) == 1) {
>     // do something here
>     mb();
> }
>
> LOAD(b);
>
> Can LOAD(b) be reordered with LOAD(a)?

Well, I think yes it can. But I'd suggest you to ask somebody else ;)

So, without rmb() I think it is theoretically possible that we read
test_bit() before we get list_empty_careful() == T.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/