# git rev-parse -q --verify 472e5b056f000a778abb41f1e443de58eb259783^{commit} 472e5b056f000a778abb41f1e443de58eb259783 already have revision, skipping fetch # git checkout -q -f -B kisskb 472e5b056f000a778abb41f1e443de58eb259783 # git clean -qxdf # < git log -1 # commit 472e5b056f000a778abb41f1e443de58eb259783 # Author: Linus Torvalds # Date: Thu Oct 1 19:14:36 2020 -0700 # # pipe: remove pipe_wait() and fix wakeup race with splice # # The pipe splice code still used the old model of waiting for pipe IO by # using a non-specific "pipe_wait()" that waited for any pipe event to # happen, which depended on all pipe IO being entirely serialized by the # pipe lock. So by checking the state you were waiting for, and then # adding yourself to the wait queue before dropping the lock, you were # guaranteed to see all the wakeups. # # Strictly speaking, the actual wakeups were not done under the lock, but # the pipe_wait() model still worked, because since the waiter held the # lock when checking whether it should sleep, it would always see the # current state, and the wakeup was always done after updating the state. # # However, commit 0ddad21d3e99 ("pipe: use exclusive waits when reading or # writing") split the single wait-queue into two, and in the process also # made the "wait for event" code wait for _two_ wait queues, and that then # showed a race with the wakers that were not serialized by the pipe lock. # # It's only splice that used that "pipe_wait()" model, so the problem # wasn't obvious, but Josef Bacik reports: # # "I hit a hang with fstest btrfs/187, which does a btrfs send into # /dev/null. This works by creating a pipe, the write side is given to # the kernel to write into, and the read side is handed to a thread that # splices into a file, in this case /dev/null. # # The box that was hung had the write side stuck here [pipe_write] and # the read side stuck here [splice_from_pipe_next -> pipe_wait]. # # [ more details about pipe_wait() scenario ] # # The problem is we're doing the prepare_to_wait, which sets our state # each time, however we can be woken up either with reads or writes. In # the case above we race with the WRITER waking us up, and re-set our # state to INTERRUPTIBLE, and thus never break out of schedule" # # Josef had a patch that avoided the issue in pipe_wait() by just making # it set the state only once, but the deeper problem is that pipe_wait() # depends on a level of synchonization by the pipe mutex that it really # shouldn't. And the whole "wait for any pipe state change" model really # isn't very good to begin with. # # So rather than trying to work around things in pipe_wait(), remove that # legacy model of "wait for arbitrary pipe event" entirely, and actually # create functions that wait for the pipe actually being readable or # writable, and can do so without depending on the pipe lock serializing # everything. # # Fixes: 0ddad21d3e99 ("pipe: use exclusive waits when reading or writing") # Link: https://lore.kernel.org/linux-fsdevel/bfa88b5ad6f069b2b679316b9e495a970130416c.1601567868.git.josef@toxicpanda.com/ # Reported-by: Josef Bacik # Reviewed-and-tested-by: Josef Bacik # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux-ld --version # < git log --format=%s --max-count=1 472e5b056f000a778abb41f1e443de58eb259783 # < make -s -j 10 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- randconfig KCONFIG_SEED=0x8CC112C8 # Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y # yes \n | make -s -j 10 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- oldconfig yes: standard output: Broken pipe # make -s -j 10 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- /kisskb/src/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning (dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but its #address-cells (1) differs from / (2) /kisskb/src/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning (dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but its #size-cells (1) differs from / (2) /kisskb/src/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning (dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but its #address-cells (1) differs from / (2) /kisskb/src/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning (dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but its #size-cells (1) differs from / (2) /kisskb/src/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning (dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but its #address-cells (1) differs from / (2) /kisskb/src/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning (dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but its #size-cells (1) differs from / (2) In file included from : /kisskb/src/drivers/media/platform/ti-vpe/cal.h: In function 'cal_read_field': /kisskb/src/include/linux/compiler_types.h:319:38: error: call to '__compiletime_assert_309' declared with attribute error: FIELD_GET: mask is not constant _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ /kisskb/src/include/linux/compiler_types.h:300:4: note: in definition of macro '__compiletime_assert' prefix ## suffix(); \ ^~~~~~ /kisskb/src/include/linux/compiler_types.h:319:2: note: in expansion of macro '_compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^~~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/bitfield.h:46:3: note: in expansion of macro 'BUILD_BUG_ON_MSG' BUILD_BUG_ON_MSG(!__builtin_constant_p(_mask), \ ^~~~~~~~~~~~~~~~ /kisskb/src/include/linux/bitfield.h:108:3: note: in expansion of macro '__BF_FIELD_CHECK' __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ ^~~~~~~~~~~~~~~~ /kisskb/src/drivers/media/platform/ti-vpe/cal.h:220:9: note: in expansion of macro 'FIELD_GET' return FIELD_GET(mask, cal_read(cal, offset)); ^~~~~~~~~ /kisskb/src/include/linux/compiler_types.h:319:38: error: call to '__compiletime_assert_313' declared with attribute error: BUILD_BUG_ON failed: (((mask) + (1ULL << (__builtin_ffsll(mask) - 1))) & (((mask) + (1ULL << (__builtin_ffsll(mask) - 1))) - 1)) != 0 _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ /kisskb/src/include/linux/compiler_types.h:300:4: note: in definition of macro '__compiletime_assert' prefix ## suffix(); \ ^~~~~~ /kisskb/src/include/linux/compiler_types.h:319:2: note: in expansion of macro '_compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^~~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/build_bug.h:50:2: note: in expansion of macro 'BUILD_BUG_ON_MSG' BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition) ^~~~~~~~~~~~~~~~ /kisskb/src/include/linux/build_bug.h:21:2: note: in expansion of macro 'BUILD_BUG_ON' BUILD_BUG_ON(((n) & ((n) - 1)) != 0) ^~~~~~~~~~~~ /kisskb/src/include/linux/bitfield.h:54:3: note: in expansion of macro '__BUILD_BUG_ON_NOT_POWER_OF_2' __BUILD_BUG_ON_NOT_POWER_OF_2((_mask) + \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/bitfield.h:108:3: note: in expansion of macro '__BF_FIELD_CHECK' __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ ^~~~~~~~~~~~~~~~ /kisskb/src/drivers/media/platform/ti-vpe/cal.h:220:9: note: in expansion of macro 'FIELD_GET' return FIELD_GET(mask, cal_read(cal, offset)); ^~~~~~~~~ make[5]: *** [/kisskb/src/scripts/Makefile.build:283: drivers/media/platform/ti-vpe/cal-camerarx.o] Error 1 make[4]: *** [/kisskb/src/scripts/Makefile.build:500: drivers/media/platform/ti-vpe] Error 2 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [/kisskb/src/scripts/Makefile.build:500: drivers/media/platform] Error 2 make[3]: *** Waiting for unfinished jobs.... make[2]: *** [/kisskb/src/scripts/Makefile.build:500: drivers/media] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/kisskb/src/Makefile:1784: drivers] Error 2 make: *** [Makefile:185: __sub-make] Error 2 Command 'make -s -j 10 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- ' returned non-zero exit status 2 # rm -rf /kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 # Build took: 0:04:36.779388