eventdev: fix race condition on timer list counter

The n_poll_lcores counter and poll_lcore array are shared between lcores
and the update of these variables are out of the protection of spinlock
on each lcore timer list. The read-modify-write operations of the counter
are not atomic, so it has the potential of race condition between lcores.

Use c11 atomics with RELAXED ordering to prevent confliction.

Fixes: cc7b73ea9e3b ("eventdev: add new software timer adapter")
Cc: stable@dpdk.org
Signed-off-by: Phil Yang <phil.yang@arm.com>
Reviewed-by: Dharmik Thakkar <dharmik.thakkar@arm.com>
Reviewed-by: Ruifeng Wang <ruifeng.wang@arm.com>
Acked-by: Erik Gabriel Carrillo <erik.g.carrillo@intel.com>

diff --git a/lib/librte_eventdev/rte_event_timer_adapter.c b/lib/librte_eventdev/rte_event_timer_adapter.c
index 2321803..370ea40 100644 (file)
--- a/lib/librte_eventdev/rte_event_timer_adapter.c
+++ b/lib/librte_eventdev/rte_event_timer_adapter.c
@@ -583,6 +583,7 @@ swtim_callback(struct rte_timer *tim)
        uint16_t nb_evs_invalid = 0;
        uint64_t opaque;
        int ret;
+       int n_lcores;
 
        opaque = evtim->impl_opaque[1];
        adapter = (struct rte_event_timer_adapter *)(uintptr_t)opaque;
@@ -605,8 +606,12 @@ swtim_callback(struct rte_timer *tim)
                                      "with immediate expiry value");
                }
 
-               if (unlikely(rte_atomic16_test_and_set(&sw->in_use[lcore].v)))
-                       sw->poll_lcores[sw->n_poll_lcores++] = lcore;
+               if (unlikely(rte_atomic16_test_and_set(&sw->in_use[lcore].v))) {
+                       n_lcores = __atomic_fetch_add(&sw->n_poll_lcores, 1,
+                                                    __ATOMIC_RELAXED);
+                       __atomic_store_n(&sw->poll_lcores[n_lcores], lcore,
+                                       __ATOMIC_RELAXED);
+               }
        } else {
                EVTIM_BUF_LOG_DBG("buffered an event timer expiry event");
 
@@ -1011,6 +1016,7 @@ __swtim_arm_burst(const struct rte_event_timer_adapter *adapter,
        uint32_t lcore_id = rte_lcore_id();
        struct rte_timer *tim, *tims[nb_evtims];
        uint64_t cycles;
+       int n_lcores;
 
 #ifdef RTE_LIBRTE_EVENTDEV_DEBUG
        /* Check that the service is running. */
@@ -1033,8 +1039,10 @@ __swtim_arm_burst(const struct rte_event_timer_adapter *adapter,
        if (unlikely(rte_atomic16_test_and_set(&sw->in_use[lcore_id].v))) {
                EVTIM_LOG_DBG("Adding lcore id = %u to list of lcores to poll",
                              lcore_id);
-               sw->poll_lcores[sw->n_poll_lcores] = lcore_id;
-               ++sw->n_poll_lcores;
+               n_lcores = __atomic_fetch_add(&sw->n_poll_lcores, 1,
+                                            __ATOMIC_RELAXED);
+               __atomic_store_n(&sw->poll_lcores[n_lcores], lcore_id,
+                               __ATOMIC_RELAXED);
        }
 
        ret = rte_mempool_get_bulk(sw->tim_pool, (void **)tims,