rcu: Fix exp_funnel_lock()/rcu_exp_wait_wake() datarace

paulmckrcu · paulmckrcu · commit 24bb9eccf7ff · 2020-02-20T15:58:21.000-08:00
The rcu_node structure's -&gt;exp_seq_rq field is accessed locklessly, so
updates must use WRITE_ONCE().  This commit therefore adds the needed
WRITE_ONCE() invocation where it was missed.

This data race was reported by KCSAN.  Not appropriate for backporting
due to failure being unlikely.

Signed-off-by: Paul E. McKenney &lt;paulmck@kernel.org&gt;
diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
@@ -589,7 +589,7 @@ static void rcu_exp_wait_wake(unsigned long s)
 			spin_lock(&rnp->exp_lock);
 			/* Recheck, avoid hang in case someone just arrived. */
 			if (ULONG_CMP_LT(rnp->exp_seq_rq, s))
-				rnp->exp_seq_rq = s;
+				WRITE_ONCE(rnp->exp_seq_rq, s);
 			spin_unlock(&rnp->exp_lock);
 		}
 		smp_mb(); /* All above changes before wakeup. */

Original file line number	Diff line number	Diff line change
`@@ -589,7 +589,7 @@ static void rcu_exp_wait_wake(unsigned long s)`
`589`	`589`	`spin_lock(&rnp->exp_lock);`
`590`	`590`	`/* Recheck, avoid hang in case someone just arrived. */`
`591`	`591`	`if (ULONG_CMP_LT(rnp->exp_seq_rq, s))`
`592`		`- rnp->exp_seq_rq = s;`
	`592`	`+ WRITE_ONCE(rnp->exp_seq_rq, s);`
`593`	`593`	`spin_unlock(&rnp->exp_lock);`
`594`	`594`	`}`
`595`	`595`	`smp_mb(); /* All above changes before wakeup. */`