linux-kernel - Re: blk-softirq vs smp_call_function_single

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200608155833.GC2531@hirez.programming.kicks-ass.net>
Date:   Mon, 8 Jun 2020 17:58:33 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Christoph Hellwig <hch@...radead.org>
Cc:     Jens Axboe <axboe@...nel.dk>, frederic@...nel.org,
        linux-kernel@...r.kernel.org, linux-block@...r.kernel.org
Subject: Re: blk-softirq vs smp_call_function_single_async()

On Mon, Jun 08, 2020 at 08:45:57AM -0700, Christoph Hellwig wrote:
> On Mon, Jun 08, 2020 at 01:58:00PM +0200, Peter Zijlstra wrote:
> > Hi Jens,
> > 
> > I've been going through smp_call_function_single_async() users and
> > stumbled upon blk-softirq.c, which has:
> > 
> > static int raise_blk_irq(int cpu, struct request *rq)
> > {
> > 	if (cpu_online(cpu)) {
> > 		call_single_data_t *data = &rq->csd;
> > 
> > 		data->func = trigger_softirq;
> > 		data->info = rq;
> > 		data->flags = 0;
> > 
> > 		smp_call_function_single_async(cpu, data);
> > 		return 0;
> > 	}
> > 
> > 	return 1;
> > }
> > 
> > What, if anything, guarantees rq->csd is not already in use at that
> > time?
> 
> A request can only be completed once.

Sure, but that doesn't help.

CPU0				CPU1

 raise_blk_irq()		BLOCK_SOFTIRQ
   IPI -> CPU1

				// picks up thing from CPU0
				req->complete(req);


	<big hole where CSD is active and request completed>

				<IPI>
				  trigger_softirq()


What happens to a struct request after completion, is it free()d
or reused? If reused, how do we guarantee CSD completion before
free()ing?