Re: [PATCH 0/4] Fix forward()/expires() racing with concurrent arming

"FUJITA Tomonori" <[email protected]> writes:

> On Tue, 18 Aug 2026 11:02:27 +0200
> Andreas Hindborg <[email protected]> wrote:
>
>>> perf and CFS bandwidth have a flag as well as a lock. The flag is "do
>>> not arm while armed", which is the same rule the types enforce
>>> here. rtc and the softlockup watchdog look like they cancel first and
>>> then start instead. None of them arms a timer that is active, so I
>>> would rather the abstraction did not allow it either. Does that seem
>>> reasonable?
>>
>> I am fine with preventing starting a timer that is Started or Running,
>> but I am not liking the `UniqueArc` requirement.
>>
>> I have a use case in `rnull` where I have to start a timer behind an
>> `Arc` with no way to obtain a `UniqueArc`, so I would prefer if that use
>> case keeps on working. Without this, I would have to allocate a box and
>> put it behind a lock, leading to double indirection.
>
> Before the UniqueArc requirement, I would like to check which timer
> you have in mind? The bandwidth timer, the per-command timer, or
> something else? The two seem to need different things, so I would
> rather not guess.

The bandwidth timer. It is started from an `Arc<NullBlkDevice>:
HasHrTimer`. If we make the suggested change to `ArcTimerHandle`, I
think I would need to change the `NullBlkDevice::bandwidth_timer` from
an embedded `HrTimer` to a `SpinLock<Box<HrTimer>>` or something like
that.

Maybe this is fine. I don't think it will affect performance for `rnull`
- this is already a throttled path. But it gives slightly more
convoluted code in the caller by reducing the way we can use the API.

>
> For the bandwidth timer I do not see where the handle would live, and that
> is independent of UniqueArc. start() returns a handle that cancels the
> timer when it is dropped, so it has to be kept somewhere, and the current
> hrtimer API is the same. queue_rq() only gets a shared borrow of the queue
> data, and the handle owns an Arc<T>, so putting it inside T means T holds a
> refcount on itself and is never freed.

The storage of the handle would not change.

Circular references to keep things alive can be fine.

For the completion timer, the change you propose would work fine I
think. I would just start the timer via the unique request reference
rather than the shared one. This is probably a better way to do it
anyway.


Best regards,
Andreas Hindborg