linux-kernel - Re: [PATCH] locking/rwsem: Remove unnessary check in rwsem_down_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89bd35a9-ea64-4974-af8e-a033b93d005a@shopee.com>
Date:   Fri, 10 Nov 2023 19:00:33 +0800
From:   Haifeng Xu <haifeng.xu@...pee.com>
To:     Tang Yizhou <yizhou.tang@...pee.com>
Cc:     Waiman Long <longman@...hat.com>, peterz@...radead.org,
        mingo@...hat.com, will@...nel.org, boqun.feng@...il.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] locking/rwsem: Remove unnessary check in
 rwsem_down_read_slowpath()



On 2023/11/10 14:54, Tang Yizhou wrote:
> On Thu, Nov 9, 2023 at 11:17 AM Haifeng Xu <haifeng.xu@...pee.com> wrote:
>>
>> reader          writer                                  reader
>>
>> acquire
>> release
>>                 rwsem_write_trylock
>>                         set RWSEM_WRITER_LOCKED
>>                                                         rwsem_down_read_slowpath
>>                         set owner
>>
>> If prev lock holder is a reader, when it releases the lock, the owner isn't cleared(CONFIG_DEBUG_RWSEMS isn't enabled).
>> A writer comes and can set the RWSEM_WRITER_LOCKED bit succsessfully, then a new reader run into slow path, before
>> the writer set the owner, the new reader will see that both the RWSEM_READER_OWNED bit and RWSEM_WRITER_LOCKED bit are
>> set.
>>
> 
> For the above example, it won't cause a problem. When the writer
> successfully sets RWSEM_WRITER_LOCKED, the reader, when reading rcnt
> through rwsem_down_read_slowpath(), will see that rcnt is 0 and will
> jump to the queue label.
> 
> Thanks,
> Tang

In this case, rcnt is not 0, it's 1, because rwsem_read_trylock() has add RWSEM_READER_BIAS, so if more than one new reader comes,
it could be the case.

reader		writer					reader									reader

acquire
release
		rwsem_write_trylock
			set RWSEM_WRITER_LOCKED
							rwsem_down_read_slowpath						rwsem_down_read_slowpath
			
								...									check RWSEM_WRITER_LOCKED bit(rcnt=2)
								

								count = atomic_long_add_return(adjustment, &sem->count);

			set owner