srcu: Force synchronization for srcu_get_delay()

Currently, srcu_get_delay() can be called concurrently, for example,
by a CPU that is the first to request a new grace period and the CPU
processing the current grace period.  Although concurrent access is
harmless, it unnecessarily expands the state space.  Additionally,
all calls to srcu_get_delay() are from slow paths.

This commit therefore protects all calls to srcu_get_delay() with
ssp->srcu_sup->lock, which is already held on the invocation from the
srcu_funnel_gp_start() function.  While in the area, this commit also
adds a lockdep_assert_held() to srcu_get_delay() itself.

Reported-by: syzbot+16a19b06125a2963eaee@syzkaller.appspotmail.com
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: <bpf@vger.kernel.org>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>

diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 247bdf42fb541cb36b2e5427f76c821724e70fce..121dd290cae144abfffc1ecb3d9d7c5df55ebe7f 100644 (file)
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -648,6 +648,7 @@ static unsigned long srcu_get_delay(struct srcu_struct *ssp)
        unsigned long jbase = SRCU_INTERVAL;
        struct srcu_usage *sup = ssp->srcu_sup;
 
+       lockdep_assert_held(&ACCESS_PRIVATE(ssp->srcu_sup, lock));
        if (srcu_gp_is_expedited(ssp))
                jbase = 0;
        if (rcu_seq_state(READ_ONCE(sup->srcu_gp_seq))) {
@@ -675,9 +676,13 @@ static unsigned long srcu_get_delay(struct srcu_struct *ssp)
 void cleanup_srcu_struct(struct srcu_struct *ssp)
 {
        int cpu;
+       unsigned long delay;
        struct srcu_usage *sup = ssp->srcu_sup;
 
-       if (WARN_ON(!srcu_get_delay(ssp)))
+       spin_lock_irq_rcu_node(ssp->srcu_sup);
+       delay = srcu_get_delay(ssp);
+       spin_unlock_irq_rcu_node(ssp->srcu_sup);
+       if (WARN_ON(!delay))
                return; /* Just leak it! */
        if (WARN_ON(srcu_readers_active(ssp)))
                return; /* Just leak it! */
@@ -1101,7 +1106,9 @@ static bool try_check_zero(struct srcu_struct *ssp, int idx, int trycount)
 {
        unsigned long curdelay;
 
+       spin_lock_irq_rcu_node(ssp->srcu_sup);
        curdelay = !srcu_get_delay(ssp);
+       spin_unlock_irq_rcu_node(ssp->srcu_sup);
 
        for (;;) {
                if (srcu_readers_active_idx_check(ssp, idx))
@@ -1850,7 +1857,9 @@ static void process_srcu(struct work_struct *work)
        ssp = sup->srcu_ssp;
 
        srcu_advance_state(ssp);
+       spin_lock_irq_rcu_node(ssp->srcu_sup);
        curdelay = srcu_get_delay(ssp);
+       spin_unlock_irq_rcu_node(ssp->srcu_sup);
        if (curdelay) {
                WRITE_ONCE(sup->reschedule_count, 0);
        } else {