locking/mutexes/mcs: Correct barrier usage

This patch corrects the way memory barriers are used in the MCS lock
with smp_load_acquire and smp_store_release fucnctions.  The previous
barriers could leak critical sections if mcs lock is used by itself.
It is not a problem when mcs lock is embedded in mutex but will be an
issue when the mcs_lock is used elsewhere.

The patch removes the incorrect barriers and put in correct
barriers with the pair of functions smp_load_acquire and smp_store_release.

Suggested-by: Michel Lespinasse <walken@google.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Waiman Long <Waiman.Long@hp.com>
Signed-off-by: Jason Low <jason.low2@hp.com>
Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1390347353.3138.62.camel@schen9-DESK
Signed-off-by: Ingo Molnar <mingo@kernel.org>

1 files changed, 13 insertions, 5 deletions

diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 4dd6e4c219de..fbbd2eda867e 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -136,9 +136,12 @@ void mspin_lock(struct mspin_node **lock, struct mspin_node *node)
                 return;
         }
         ACCESS_ONCE(prev->next) = node;
-        smp_wmb();
-        /* Wait until the lock holder passes the lock down */
-        while (!ACCESS_ONCE(node->locked))
+        /*
+         * Wait until the lock holder passes the lock down.
+         * Using smp_load_acquire() provides a memory barrier that
+         * ensures subsequent operations happen after the lock is acquired.
+         */
+        while (!(smp_load_acquire(&node->locked)))
                 arch_mutex_cpu_relax();
 }
 
@@ -156,8 +159,13 @@ static void mspin_unlock(struct mspin_node **lock, struct mspin_node *node)
                 while (!(next = ACCESS_ONCE(node->next)))
                         arch_mutex_cpu_relax();
         }
-        ACCESS_ONCE(next->locked) = 1;
-        smp_wmb();
+        /*
+         * Pass lock to next waiter.
+         * smp_store_release() provides a memory barrier to ensure
+         * all operations in the critical section has been completed
+         * before unlocking.
+         */
+        smp_store_release(&next->locked, 1);
 }
 
 /*