Messages in this thread | | | Date | Fri, 16 Aug 2019 13:41:59 -0400 (EDT) | From | Mathieu Desnoyers <> | Subject | Re: [PATCH 1/1] Fix: trace sched switch start/stop racy updates |
| |
----- On Aug 16, 2019, at 1:04 PM, rostedt rostedt@goodmis.org wrote:
> On Fri, 16 Aug 2019 17:48:59 +0100 > Valentin Schneider <valentin.schneider@arm.com> wrote: > >> On 16/08/2019 17:25, Steven Rostedt wrote: >> >> Also, write and read to/from those variables should be done with >> >> WRITE_ONCE() and READ_ONCE(), given that those are read within tracing >> >> probes without holding the sched_register_mutex. >> >> >> > >> > I understand the READ_ONCE() but is the WRITE_ONCE() truly necessary? >> > It's done while holding the mutex. It's not that critical of a path, >> > and makes the code look ugly. >> > >> >> I seem to recall something like locking primitives don't protect you from >> store tearing / invented stores, so if you can have concurrent readers >> using READ_ONCE(), there should be a WRITE_ONCE() on the writer side, even >> if it's done in a critical section. > > But for this, it really doesn't matter. The READ_ONCE() is for going > from 0->1 or 1->0 any other change is the same as 1.
Let's consider this "invented store" scenario (even though as I noted in my earlier email, I suspect this particular instance of the code does not appear to fit the requirements to generate this in the wild with current compilers):
intial state:
sched_tgid_ref = 10;
Thread A Thread B
registration tracepoint probe sched_tgid_ref++ - compiler decides to invent a store: sched_tgid_ref = 0 READ_ONCE(sched_tgid_ref) -> observes 0, but should really see either 10 or 11. - compiler stores 11 into sched_tgid_ref
This kind of scenario could cause spurious missing data in the middle of a trace caused by another user trying to increment the reference count, which is really unexpected.
A similar scenario can happen for "store tearing" if the compiler decides to break the store into many stores close to the 16-bit overflow value when updating a 32-bit reference count. Spurious 1 -> 0 -> 1 transitions could be observed by readers.
> When we enable trace events, we start recording the tasks comms such > that we can possibly map them to the pids. When we disable trace > events, we stop recording the comms so that we don't overwrite the > cache when not needed. Note, if more than the max cache of tasks are > recorded during a session, we are likely to miss comms anyway. > > Thinking about this more, the READ_ONCE() and WRTIE_ONCE() are not even > needed, because this is just a best effort anyway.
If you choose not to use READ_ONCE(), then the "load tearing" issue can cause similar spurious 1 -> 0 -> 1 transitions near 16-bit counter overflow as described above. The "Invented load" also becomes an issue, because the compiler could use the loaded value for a branch, and re-load that value between two branches which are expected to use the same value, effectively generating a corrupted state.
I think we need a statement about whether READ_ONCE/WRITE_ONCE should be used in this kind of situation, or if we are fine dealing with the awkward compiler side-effects when they will occur.
Thanks,
Mathieu
> > The only real fix was to move the check into the mutex protect area, > because that can cause a real bug if there was a race. > > { > - bool sched_register = (!sched_cmdline_ref && !sched_tgid_ref); > + bool sched_register; > + > mutex_lock(&sched_register_mutex); > + sched_register = (!sched_cmdline_ref && !sched_tgid_ref); > > Thus, I'd like to see a v2 of this patch without the READ_ONCE() or > WRITE_ONCE() added. > > -- Steve
-- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com
| |