Re: aio_wait_bh_oneshot() thread-safety question

[Emanuele Giuseppe Esposito]

Am 24/05/2022 um 09:08 schrieb Paolo Bonzini:
> On 5/23/22 18:04, Vladimir Sementsov-Ogievskiy wrote:
>>
>> I have a doubt about how aio_wait_bh_oneshot() works. Exactly, I see
>> that data->done is not accessed atomically, and doesn't have any
>> barrier protecting it..
>>
>> Is following possible:
>>
>> main-loop                           iothread
>>                                  |
>> aio_wait_bh_oneshot()           |
>>      aio_bh_schedule_oneshot()   |
>>                                  |  handle bh:
>>                                  | 1. set data->done = true
>>                                  | 2. call aio_wait_kick(), inserting the
>>                                  | dummy bh into main context
>>                                  |
>>   ... in AIO_WAIT_WHILE():
>>     handle dummy bh, go to next
>>     iteration, but still read
>>     data->done=false due to some
>>     processor data reordering,
>>     go to next iteration of polling
>>     and hang
> Yes, barriers are missing:
> 
> https://lore.kernel.org/qemu-devel/You6FburTi7gVyxy@stefanha-x1.localdomain/T/#md97146c6eae1fce2ddd687fdc3f2215eee03f6f4
> 
> 
> It seems like the issue was never observed, at least on x86.
> 
> Paolo
> 

Sent the fix as a separate patch:
20220524173054.12651-1-eesposit@redhat.com/">https://patchew.org/QEMU/20220524173054.12651-1-eesposit@redhat.com/

Thank you,
Emanuele