Re: [PATCH] fix a race condition in cancelable mcs spinlocks

John David Anglin
2014-06-01T20:53:53Z

On 1-Jun-14, at 3:20 PM, Peter Zijlstra wrote:

>> If you write to some variable with ACCESS_ONCE and use cmpxchg or
>> xchg at
>> the same time, you break it. ACCESS_ONCE doesn't take the hashed
>> spinlock,
>> so, in this case, cmpxchg or xchg isn't really atomic at all.
>
> And this is really the first place in the kernel that breaks like
> this?
> I've been using xchg() and cmpxchg() without such consideration for
> quite a while.

I believe Mikulas is correct. Even in a controlled situation where a
cmpxchg operation
is used to implement pthread_spin_lock() in userspace, we found
recently that the lock
must be released with a cmpxchg operation and not a simple write on
SMP systems.
There is a race in the cache operations or instruction ordering that's
not present with
the ldcw instruction.

Dave
--
John David Anglin dave.anglin@bell.net