Messages in this thread | | | From | John David Anglin <> | Subject | Re: [PATCH] fix a race condition in cancelable mcs spinlocks | Date | Sun, 1 Jun 2014 16:46:26 -0400 |
| |
On 1-Jun-14, at 3:20 PM, Peter Zijlstra wrote:
>> If you write to some variable with ACCESS_ONCE and use cmpxchg or >> xchg at >> the same time, you break it. ACCESS_ONCE doesn't take the hashed >> spinlock, >> so, in this case, cmpxchg or xchg isn't really atomic at all. > > And this is really the first place in the kernel that breaks like > this? > I've been using xchg() and cmpxchg() without such consideration for > quite a while.
I believe Mikulas is correct. Even in a controlled situation where a cmpxchg operation is used to implement pthread_spin_lock() in userspace, we found recently that the lock must be released with a cmpxchg operation and not a simple write on SMP systems. There is a race in the cache operations or instruction ordering that's not present with the ldcw instruction.
Dave -- John David Anglin dave.anglin@bell.net
| |