Commit d31e3136 authored by Paul E. McKenney's avatar Paul E. McKenney Committed by Boqun Feng
Browse files

srcu: Force synchronization for srcu_get_delay() 



Currently, srcu_get_delay() can be called concurrently, for example,
by a CPU that is the first to request a new grace period and the CPU
processing the current grace period.  Although concurrent access is
harmless, it unnecessarily expands the state space.  Additionally,
all calls to srcu_get_delay() are from slow paths.

This commit therefore protects all calls to srcu_get_delay() with
ssp->srcu_sup->lock, which is already held on the invocation from the
srcu_funnel_gp_start() function.  While in the area, this commit also
adds a lockdep_assert_held() to srcu_get_delay() itself.

Reported-by: default avatar <syzbot+16a19b06125a2963eaee@syzkaller.appspotmail.com>
Signed-off-by: default avatarPaul E. McKenney <paulmck@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: <bpf@vger.kernel.org>
Signed-off-by: default avatarBoqun Feng <boqun.feng@gmail.com>
parent 821ca6fa

kernel/rcu/srcutree.c

+10 −1
Original line number Diff line number Diff line
@@ -648,6 +648,7 @@ static unsigned long srcu_get_delay(struct srcu_struct *ssp) 
	unsigned long jbase = SRCU_INTERVAL;

	struct srcu_usage *sup = ssp->srcu_sup;



	lockdep_assert_held(&ACCESS_PRIVATE(ssp->srcu_sup, lock));

	if (srcu_gp_is_expedited(ssp))

		jbase = 0;

	if (rcu_seq_state(READ_ONCE(sup->srcu_gp_seq))) {
@@ -675,9 +676,13 @@ static unsigned long srcu_get_delay(struct srcu_struct *ssp) 
void cleanup_srcu_struct(struct srcu_struct *ssp)

{

	int cpu;

	unsigned long delay;

	struct srcu_usage *sup = ssp->srcu_sup;



	if (WARN_ON(!srcu_get_delay(ssp)))

	spin_lock_irq_rcu_node(ssp->srcu_sup);

	delay = srcu_get_delay(ssp);

	spin_unlock_irq_rcu_node(ssp->srcu_sup);

	if (WARN_ON(!delay))

		return; /* Just leak it! */

	if (WARN_ON(srcu_readers_active(ssp)))

		return; /* Just leak it! */
@@ -1101,7 +1106,9 @@ static bool try_check_zero(struct srcu_struct *ssp, int idx, int trycount) 
{

	unsigned long curdelay;



	spin_lock_irq_rcu_node(ssp->srcu_sup);

	curdelay = !srcu_get_delay(ssp);

	spin_unlock_irq_rcu_node(ssp->srcu_sup);



	for (;;) {

		if (srcu_readers_active_idx_check(ssp, idx))
@@ -1850,7 +1857,9 @@ static void process_srcu(struct work_struct *work) 
	ssp = sup->srcu_ssp;



	srcu_advance_state(ssp);

	spin_lock_irq_rcu_node(ssp->srcu_sup);

	curdelay = srcu_get_delay(ssp);

	spin_unlock_irq_rcu_node(ssp->srcu_sup);

	if (curdelay) {

		WRITE_ONCE(sup->reschedule_count, 0);

	} else {