Re: Several races in "usbnet" module (kernel 4.1.x)

2015-08-14 Thread Eugene Shatokhin
Hi, 21.07.2015 17:22, Oliver Neukum пишет: On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: And here, the code clears EVENT_RX_KILL bit in dev->flags, which may execute concurrently with the above operation: #0 clear_bit (bitops.h:113, inlined) #1 usbnet_bh (usbnet.c:1475) /*

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-27 Thread Eugene Shatokhin
27.07.2015 13:00, Oliver Neukum пишет: On Fri, 2015-07-24 at 17:41 +0300, Eugene Shatokhin wrote: 23.07.2015 12:15, Oliver Neukum пишет: From what I see now in Documentation/atomic_ops.txt, stores to the properly aligned memory locations are in fact atomic. They are, but again only with r

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-27 Thread Eugene Shatokhin
27.07.2015 15:29, Oliver Neukum пишет: On Fri, 2015-07-24 at 20:38 +0300, Eugene Shatokhin wrote: 21.07.2015 15:04, Oliver Neukum пишет: your analysis is correct and it looks like in addition to your proposed fix locking needs to be simplified and a common lock to be taken. Suggestions? Jus

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-27 Thread Oliver Neukum
On Fri, 2015-07-24 at 20:38 +0300, Eugene Shatokhin wrote: > 21.07.2015 15:04, Oliver Neukum пишет: > > your analysis is correct and it looks like in addition to your proposed > > fix locking needs to be simplified and a common lock to be taken. > > Suggestions? > > Just an idea, I haven't tested

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-27 Thread Oliver Neukum
On Fri, 2015-07-24 at 17:41 +0300, Eugene Shatokhin wrote: > 23.07.2015 12:15, Oliver Neukum пишет: > From what I see now in Documentation/atomic_ops.txt, stores to the > properly aligned memory locations are in fact atomic. They are, but again only with respect to each other. > So, I think, t

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-24 Thread Eugene Shatokhin
21.07.2015 15:04, Oliver Neukum пишет: On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: Hi, I have recently found several data races in "usbnet" module, checked on vanilla kernel 4.1.0 on x86_64. The races do actually happen, I have confirmed it by adding delays and using hardware bre

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-24 Thread Eugene Shatokhin
23.07.2015 12:15, Oliver Neukum пишет: On Wed, 2015-07-22 at 21:33 +0300, Eugene Shatokhin wrote: The following part is not necessary, I think. usbnet_bh() does not touch EVENT_NO_RUNTIME_PM bit explicitly and these bit operations are atomic w.r.t. each other. + mpn |= !test_and_clear_bit(

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-23 Thread Eugene Shatokhin
23.07.2015 12:43, Oliver Neukum пишет: On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: [Race #5] Race on dev->rx_urb_size. I reproduced it a similar way as the races #2 and #3 (changing MTU while downloading files). dev->rx_urb_size is written to here: #0 usbnet_change_mtu (usbnet.

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-23 Thread Oliver Neukum
On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: > [Race #5] > > Race on dev->rx_urb_size. I reproduced it a similar way as the races > #2 > and #3 (changing MTU while downloading files). > > dev->rx_urb_size is written to here: > #0 usbnet_change_mtu (usbnet.c:392) > dev->rx_

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-23 Thread Oliver Neukum
On Wed, 2015-07-22 at 21:33 +0300, Eugene Shatokhin wrote: > The following part is not necessary, I think. usbnet_bh() does not > touch > EVENT_NO_RUNTIME_PM bit explicitly and these bit operations are > atomic > w.r.t. each other. > > > + mpn |= !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-22 Thread Eugene Shatokhin
21.07.2015 17:22, Oliver Neukum пишет: On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: And here, the code clears EVENT_RX_KILL bit in dev->flags, which may execute concurrently with the above operation: #0 clear_bit (bitops.h:113, inlined) #1 usbnet_bh (usbnet.c:1475) /* rest

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-21 Thread Oliver Neukum
On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: > And here, the code clears EVENT_RX_KILL bit in dev->flags, which may > execute concurrently with the above operation: > #0 clear_bit (bitops.h:113, inlined) > #1 usbnet_bh (usbnet.c:1475) > /* restart RX again after disabling due

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-21 Thread Oliver Neukum
On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: > Races on dev->rx_qlen. Reproduced these by repeatedly changing MTU > (1500 > <-> 1400) while downloading large files. Hi, I don't see how it matters much. The number of buffers is just an optimization. As long as it eventually is corre

Re: Several races in "usbnet" module (kernel 4.1.x)

2015-07-21 Thread Oliver Neukum
On Mon, 2015-07-20 at 21:13 +0300, Eugene Shatokhin wrote: > Hi, > > I have recently found several data races in "usbnet" module, checked on > vanilla kernel 4.1.0 on x86_64. The races do actually happen, I have > confirmed it by adding delays and using hardware breakpoints to detect > the conf

Several races in "usbnet" module (kernel 4.1.x)

2015-07-20 Thread Eugene Shatokhin
Hi, I have recently found several data races in "usbnet" module, checked on vanilla kernel 4.1.0 on x86_64. The races do actually happen, I have confirmed it by adding delays and using hardware breakpoints to detect the conflicting memory accesses (with RaceHound tool, https://github.com/winn