[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <200608022148.01297.dvhltc@us.ibm.com>
Date: Wed, 2 Aug 2006 21:48:00 -0700
From: Darren Hart <dvhltc@...ibm.com>
To: Esben Nielsen <nielsen.esben@...glemail.com>
Cc: Steven Rostedt <rostedt@...dmis.org>, Ingo Molnar <mingo@...e.hu>,
Thomas Gleixner <tglx@...utronix.de>,
LKML <linux-kernel@...r.kernel.org>
Subject: Re: [-rt] Fix race condition and following BUG in PI-futex
On Tuesday 01 August 2006 16:28, you wrote:
> On Tue, 1 Aug 2006, Steven Rostedt wrote:
> > On Tue, 2006-08-01 at 13:22 -0700, Darren Hart wrote:
> >>>> list_del_init(&pi_state->owner->pi_state_list);
> >>>> list_add(&pi_state->list, &new_owner->pi_state_list);
> >>>> pi_state->owner = new_owner;
> >>>> + atomic_inc(&pi_state->refcount);
> >>>
> >>> There really needs to be a get_pi_state() or some variant. Having to do
> >>> a manual atomic_inc is very dangerous.
> >>
> >> I understand the need to grab the wait_lock in order to serialize
> >> rt_mutex_next_owner(), but why the addition of of the atomic_inc() and
> >> the free_pi_state() ? And if we do need them, shouldn't we place them
> >> around the use of the pi_state, rather than just before the unlock
> >> calls?
> >
> > Hmm, is the inc really needed? The hb->lock is held through this and
> > the pi_state can't go away while that lock is held.
>
> I was going to ask about that... If you say so they can go. I just added
> the inc/dec to be sure.
So the only thing that frees the pi_state is free_pi_state and it's only
caller is unqueue_me_pi() which must be called with hb->lock held, so since
we already hold it, I think we're fine without the inc/free lines (as Steven
already said). The following patch has the lines removed.
The direct use of the rt_mutex wait_lock seems a little out of place here, as
it "ought to be" restricted to rt_mutex.c. Perhaps some kind of an "atomic"
rt_mutex_set_next_owner() call could abstract this away from futex.c? I
confess I don't see a way to do that without putting futex internals into
rt_mutex.c... so not really any better.
Index: 2.6.17-rt8/kernel/futex.c
===================================================================
--- 2.6.17-rt8.orig/kernel/futex.c 2006-08-02 20:29:42.000000000 -0700
+++ 2.6.17-rt8/kernel/futex.c 2006-08-02 21:39:17.000000000 -0700
@@ -565,6 +565,7 @@
if (!pi_state)
return -EINVAL;
+ spin_lock(&pi_state->pi_mutex.wait_lock);
new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
/*
@@ -598,6 +599,8 @@
list_del_init(&pi_state->owner->pi_state_list);
list_add(&pi_state->list, &new_owner->pi_state_list);
pi_state->owner = new_owner;
+
+ spin_unlock(&pi_state->pi_mutex.wait_lock);
rt_mutex_unlock(&pi_state->pi_mutex);
return 0;
--
Darren Hart
IBM Linux Technology Center
Realtime Linux Team
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists