Messages in this thread | | | Date | Fri, 08 Aug 2014 08:28:47 -0600 | From | Jens Axboe <> | Subject | Re: [PATCH] Fix race in get_request() |
| |
On 08/08/2014 08:24 AM, Jens Axboe wrote: > On 08/07/2014 06:54 PM, Jörn Engel wrote: >> Hello Jens! >> >> I came across the below while investigating some other problem. >> Something here doesn't seem right. This looks like an obvious bug and >> something roughly along the lines of my patch would fix it. But I >> must be in the wrong decade to find such a bug in the block layer. >> >> Is this for real? Or if not, what am I missing? >> >> Jörn >> >> -- >> >> If __get_request() returns NULL, get_request will call >> prepare_to_wait_exclusive() followed by io_schedule(). Not rechecking >> the sleep condition after prepare_to_wait_exclusive() leaves a race >> where the condition changes before prepare_to_wait_exclusive(), but >> not after and accordingly this thread never gets woken up. >> >> The race must be exceedingly hard to hit, otherwise I cannot explain how >> such a classic race could outlive the last millenium. > > I think that is a genuine bug, it's just extremely hard to hit in real > life. It has probably only potentially ever triggered in the cases where > we are so out of memory that a blocking ~300b alloc fails, and Linux > generally shits itself pretty hard when it gets to that stage anyway... > And for the bug to be critical, you'd need this to happen for a device > that otherwise has no IO pending, since you'd get woken up by the next > completed request anyway.
Actually, this can't trigger for an empty queue, since the mempool holds a few requests. So it should never result in a softlock, we will make progress. Given that we also still hold the queue spinlock (that will be held for a free as well), we should not be able to get a free of a request until the prepare_to_wait() has been done. So not sure there is an actual bug there, but I agree the code looks confusing that way.
-- Jens Axboe
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |