[PATCH v1 1/1] malloc/mp: fix wait condition handling

[PATCH v1 1/1] malloc/mp: fix wait condition handling

[Anatoly Burakov]

From coverity's point of view, it is theoretically possible to have an
infinite wait on a wait condition because while we do check for timeout,
we do not check for whether the event we are waiting for has already
occurred by the time we get to the first cond_wait call (in this case,
it's state of memory request list entry's state being set to COMPLETE).

This can't really happen as the only time a wait condition is triggered
is when we are receiving a memory event (so the entry we are waiting on
cannot change before wait condition is triggered because it's protected
by a mutex), so either we receive an event and modify entry state, or we
exit wait on a timeout and do not care about request state. However, it's
better to keep coverity happy.

Coverity issue: 425709
Fixes: 07dcbfe0101f ("malloc: support multiprocess memory hotplug")
Cc: stable@dpdk.org

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
---
 lib/eal/common/malloc_mp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/eal/common/malloc_mp.c b/lib/eal/common/malloc_mp.c
index 2d39b0716f..9765277f5d 100644
--- a/lib/eal/common/malloc_mp.c
+++ b/lib/eal/common/malloc_mp.c
@@ -756,7 +756,8 @@ request_to_primary(struct malloc_mp_req *user_req)
 	do {
 		ret = pthread_cond_timedwait(&entry->cond,
 				&mp_request_list.lock, &ts);
-	} while (ret != 0 && ret != ETIMEDOUT);
+	} while ((ret != 0 && ret != ETIMEDOUT) &&
+			entry->state == REQ_STATE_ACTIVE);
 
 	if (entry->state != REQ_STATE_COMPLETE) {
 		EAL_LOG(ERR, "Request timed out");
-- 
2.43.0

Re: [PATCH v1 1/1] malloc/mp: fix wait condition handling

[Thomas Monjalon]

12/07/2024 13:41, Anatoly Burakov:
> From coverity's point of view, it is theoretically possible to have an
> infinite wait on a wait condition because while we do check for timeout,
> we do not check for whether the event we are waiting for has already
> occurred by the time we get to the first cond_wait call (in this case,
> it's state of memory request list entry's state being set to COMPLETE).
> 
> This can't really happen as the only time a wait condition is triggered
> is when we are receiving a memory event (so the entry we are waiting on
> cannot change before wait condition is triggered because it's protected
> by a mutex), so either we receive an event and modify entry state, or we
> exit wait on a timeout and do not care about request state. However, it's
> better to keep coverity happy.
> 
> Coverity issue: 425709
> Fixes: 07dcbfe0101f ("malloc: support multiprocess memory hotplug")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>

Applied, thanks.