From 6dc7943d18c67e3ed723cac7e4ea01f6fcd44e9d Mon Sep 17 00:00:00 2001 Message-Id: <6dc7943d18c67e3ed723cac7e4ea01f6fcd44e9d.1599166691.git.zanussi@kernel.org> In-Reply-To: <56457dc415803c8abc5acb513ada877a79596f05.1599166690.git.zanussi@kernel.org> References: <56457dc415803c8abc5acb513ada877a79596f05.1599166690.git.zanussi@kernel.org> From: Corey Minyard Date: Thu, 9 May 2019 14:33:20 -0500 Subject: [PATCH 265/333] sched/completion: Fix a lockup in wait_for_completion() Origin: https://www.kernel.org/pub/linux/kernel/projects/rt/4.19/older/patches-4.19.142-rt63.tar.xz Consider following race: T0 T1 T2 wait_for_completion() do_wait_for_common() __prepare_to_swait() schedule() complete() x->done++ (0 -> 1) raw_spin_lock_irqsave() swake_up_locked() wait_for_completion() wake_up_process(T0) list_del_init() raw_spin_unlock_irqrestore() raw_spin_lock_irq(&x->wait.lock) raw_spin_lock_irq(&x->wait.lock) x->done != UINT_MAX, 1 -> 0 raw_spin_unlock_irq(&x->wait.lock) return 1 while (!x->done && timeout), continue loop, not enqueued on &x->wait Basically, the problem is that the original wait queues used in completions did not remove the item from the queue in the wakeup function, but swake_up_locked() does. Fix it by adding the thread to the wait queue inside the do loop. The design of swait detects if it is already in the list and doesn't do the list add again. Cc: stable-rt@vger.kernel.org Fixes: a04ff6b4ec4ee7e ("completion: Use simple wait queues") Signed-off-by: Corey Minyard Acked-by: Steven Rostedt (VMware) Signed-off-by: Steven Rostedt (VMware) [bigeasy: shorten commit message ] Signed-off-by: Sebastian Andrzej Siewior --- kernel/sched/completion.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/completion.c b/kernel/sched/completion.c index 755a58084978..49c14137988e 100644 --- a/kernel/sched/completion.c +++ b/kernel/sched/completion.c @@ -72,12 +72,12 @@ do_wait_for_common(struct completion *x, if (!x->done) { DECLARE_SWAITQUEUE(wait); - __prepare_to_swait(&x->wait, &wait); do { if (signal_pending_state(state, current)) { timeout = -ERESTARTSYS; break; } + __prepare_to_swait(&x->wait, &wait); __set_current_state(state); raw_spin_unlock_irq(&x->wait.lock); timeout = action(timeout); -- 2.17.1