commit d094c4d5f5 ("tipc: add subscription refcount to avoid invalid
delete") accidently introduce the following deadlock scenarios:
CPU1: CPU2:
---------- ----------------
tipc_nametbl_publish
spin_lock_bh(&tn->nametbl_lock)
tipc_nametbl_insert_publ
tipc_nameseq_insert_publ
tipc_subscrp_report_overlap
tipc_subscrp_get
tipc_subscrp_send_event
tipc_close_conn
tipc_subscrb_release_cb
tipc_subscrb_delete
tipc_subscrp_put
tipc_subscrp_put
tipc_subscrp_kref_release
tipc_nametbl_unsubscribe
spin_lock_bh(&tn->nametbl_lock)
<<grab nametbl_lock again>>
CPU1: CPU2:
---------- ----------------
tipc_nametbl_stop
spin_lock_bh(&tn->nametbl_lock)
tipc_purge_publications
tipc_nameseq_remove_publ
tipc_subscrp_report_overlap
tipc_subscrp_get
tipc_subscrp_send_event
tipc_close_conn
tipc_subscrb_release_cb
tipc_subscrb_delete
tipc_subscrp_put
tipc_subscrp_put
tipc_subscrp_kref_release
tipc_nametbl_unsubscribe
spin_lock_bh(&tn->nametbl_lock)
<<grab nametbl_lock again>>
The root cause of two deadlocks is that we have to hold nametbl lock
when subscription is freed in tipc_subscrp_kref_release().
In this series we simplify tipc_subscrp_kref_release(), by moving
functions which acquire locks to other relevant places.
Patch #1: bug fix for the above issue.
Patch #2-3: improve subscription locking/refcounting.
Change log:
v3:
In v3, the subscription refcount keeps track of a subscription with
or without timer. We do not increment refcount for timer, and use
the subscriber lock plus the del_timer to find outstanding timers.
After this change tipc_subscrp_kref_release() is lock free.
v2:
As Parth's comments, subscription is still present name table after
it's expired. To fix it, we introduce a workqueue, and when
subscription's timer is expired, the subscription will be pushed to
the workqueue through its work. When the work is scheduled, the
subscription be deleted finally.
Ying Xue (3):
tipc: advance the time of calling tipc_nametbl_unsubscribe
tipc: advance the time of deleting subscription from
subscriber->subscrp_list
tipc: adjust the policy of holding subscription kref
net/tipc/name_table.c | 2 ++
net/tipc/subscr.c | 24 ++++++++++--------------
net/tipc/subscr.h | 3 +++
3 files changed, 15 insertions(+), 14 deletions(-)
--
2.1.4
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
tipc-discussion mailing list
tipc-discussion@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tipc-discussion
