From d28048db190097536aef2be5ee9a736bd7bb92eb Mon Sep 17 00:00:00 2001 From: Steven Rostedt Date: Tue, 31 Jan 2012 16:22:16 -0500 Subject: Bug with futex requeue pi I found the problem: The bug comes from a timed out condition. TASK 1 TASK 2 ------ ------ futex_wait_requeue_pi() futex_wait_queue_me() double_lock_hb(); raw_spin_lock(pi_lock); if (current->pi_blocked_on) { } else { current->pi_blocked_on = PI_WAKE_INPROGRESS; run_spin_unlock(pi_lock); spin_lock(hb->lock); <-- blocked! plist_for_each_entry_safe(this) { rt_mutex_start_proxy_lock(); task_blocks_on_rt_mutex(); BUG_ON(task->pi_blocked_on)!!!! The BUG_ON() actually has a check for PI_WAKE_INPROGRESS, but the problem is that, after TASK 1 sets PI_WAKE_INPROGRESS, it then tries to grab the hb->lock, which it fails to do so. As the hb->lock is a mutex, it will block and set the "pi_blocked_on" to the hb->lock. When TASK 2 goes to requeue it, the check for PI_WAKE_INPROGESS fails because the task1's pi_blocked_on is no longer set to that, but instead, set to the hb->lock. We need a way in rt_mutex_start_proxy_lock() to prevent this. I just added the below patch, which makes the bug go away. It's a little ugly (but no more ugly than the pi futex_requeue already is ;-) -- Steve Signed-off-by: Steven Rostedt --- kernel/rtmutex_common.h | 1 + 1 file changed, 1 insertion(+) (limited to 'kernel/rtmutex_common.h') diff --git a/kernel/rtmutex_common.h b/kernel/rtmutex_common.h index a688a299b36b..6ec3dc1eab10 100644 --- a/kernel/rtmutex_common.h +++ b/kernel/rtmutex_common.h @@ -105,6 +105,7 @@ static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock) * PI-futex support (proxy locking functions, etc.): */ #define PI_WAKEUP_INPROGRESS ((struct rt_mutex_waiter *) 1) +#define PI_REQUEUE_INPROGRESS ((struct rt_mutex_waiter *) 2) extern struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock); extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock, -- cgit v1.2.3