From patchwork Wed Jun 14 12:23:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wander Lairson Costa X-Patchwork-Id: 107940 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp1225996vqr; Wed, 14 Jun 2023 05:56:54 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6hQK5L8uAjMSEeYuz6R768GW0t56tmRKvr9YdjROekEeJW6B3UeOKi3/WVMsxzMVudFMnD X-Received: by 2002:a05:6a20:3c90:b0:119:7495:da09 with SMTP id b16-20020a056a203c9000b001197495da09mr1455369pzj.5.1686747414390; Wed, 14 Jun 2023 05:56:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686747414; cv=none; d=google.com; s=arc-20160816; b=RsNg/TYYUSs55M0tp/gYj2H2T1MudEOuUt5PoZ/3/rCTjwbkDt8c1oh7semDUU4K4A 1Z/XTIXk03je+nmPeNhOv7el/D9T5JX1qBDMH0bo581T+sFJPzNpmC0ik8GjdkqN5cCA xk4pD0N9eW0tOWBxaOZ3eHy8211NXdyBbtaSe811OvVkeo+Dc+YfS6GiZgxFCQubnCCc 9AjEPnJJKX7GZAO0NmqRXMGMm+Fcf/5zez1Gkq+Gn0bEWAWyCkfFXaewAQjzn3yRqXHE e1brHl8/N556n09YQ1JKZvSK6gKUB5rq8MSBSrI5Z5Xi53/TyG4nKE4AVXCSQKJ8xmoV BFCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=Jgi6eGMkHmhMMXRtCkaqovDV1C1lUk2FsXSrjL7Brb0=; b=GWPsFoTAwg0ddswc1VeFJ32VLJ6bqMMjnN18Y383TY3/q+bLz9ZYSw2lJVNfpL6/lA ONvXNoSvx5a5tK8gSxMsJkbOkegExuLQihy9AK4/WadhNVUsWta1Q/yWeiADz3TgAzkH CSikQx5n+bS8wOnZYAOlWPBWxwrMAtBHCVhECbUGXwAklZ/moMNb29CpSNyRwYLW00IC HI5WIiAwxT5pCNOUvzVvkumipYx8rAqhtH6csNR9292jcGF+FE2oQCqCWTcAS/9OaD/I 5WjLjXcbWx9acHQDNJMsCrH/ghj/IREHwiUVVpDkIN5he1sFZoZjrE7rg+YLkp2w8JG9 N/Ew== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=F0TqnXaI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id a7-20020a170902ecc700b001b39e50bfdasi7754046plh.638.2023.06.14.05.56.22; Wed, 14 Jun 2023 05:56:54 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=F0TqnXaI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244345AbjFNMZV (ORCPT + 99 others); Wed, 14 Jun 2023 08:25:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244603AbjFNMYf (ORCPT ); Wed, 14 Jun 2023 08:24:35 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA8411FD5 for ; Wed, 14 Jun 2023 05:23:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1686745426; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Jgi6eGMkHmhMMXRtCkaqovDV1C1lUk2FsXSrjL7Brb0=; b=F0TqnXaIA6y6B6YOQklIqiVV3ZFHSFsrjoBvcfcaGmZe5+LKWmNCz4vFECyXv9guAgBiNj BFK2W13ncqzt8jLOGAHFpY8yfOg8Oz6ZV1FD8vkojJWXCad5vKAXqAaIY1+noY98T9uHNB 3QUHTkiJDi7PJl8ufDvEUk5ngvaDXCo= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-568-ff-gMxY1P4-PnAsrbmU11A-1; Wed, 14 Jun 2023 08:23:40 -0400 X-MC-Unique: ff-gMxY1P4-PnAsrbmU11A-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 713B280120F; Wed, 14 Jun 2023 12:23:39 +0000 (UTC) Received: from fedora.redhat.com (unknown [10.22.33.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id 708D040C20F7; Wed, 14 Jun 2023 12:23:35 +0000 (UTC) From: Wander Lairson Costa To: "Christian Brauner (Microsoft)" , "Michael S. Tsirkin" , Mike Christie , Peter Zijlstra , Wander Lairson Costa , Oleg Nesterov , Kefeng Wang , Andrew Morton , Suren Baghdasaryan , "Liam R. Howlett" , Andrei Vagin , Mathieu Desnoyers , Nicholas Piggin , linux-kernel@vger.kernel.org (open list) Cc: Hu Chunyu , Valentin Schneider , Sebastian Andrzej Siewior , Paul McKenney , Steven Rostedt , Luis Goncalves Subject: [PATCH v10 1/2] kernel/fork: beware of __put_task_struct calling context Date: Wed, 14 Jun 2023 09:23:21 -0300 Message-Id: <20230614122323.37957-2-wander@redhat.com> In-Reply-To: <20230614122323.37957-1-wander@redhat.com> References: <20230614122323.37957-1-wander@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.1 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768681395122027382?= X-GMAIL-MSGID: =?utf-8?q?1768682856434001382?= Under PREEMPT_RT, __put_task_struct() indirectly acquires sleeping locks. Therefore, it can't be called from an non-preemptible context. One practical example is splat inside inactive_task_timer(), which is called in a interrupt context: CPU: 1 PID: 2848 Comm: life Kdump: loaded Tainted: G W --------- Hardware name: HP ProLiant DL388p Gen8, BIOS P70 07/15/2012 Call Trace: dump_stack_lvl+0x57/0x7d mark_lock_irq.cold+0x33/0xba ? stack_trace_save+0x4b/0x70 ? save_trace+0x55/0x150 mark_lock+0x1e7/0x400 mark_usage+0x11d/0x140 __lock_acquire+0x30d/0x930 lock_acquire.part.0+0x9c/0x210 ? refill_obj_stock+0x3d/0x3a0 ? rcu_read_lock_sched_held+0x3f/0x70 ? trace_lock_acquire+0x38/0x140 ? lock_acquire+0x30/0x80 ? refill_obj_stock+0x3d/0x3a0 rt_spin_lock+0x27/0xe0 ? refill_obj_stock+0x3d/0x3a0 refill_obj_stock+0x3d/0x3a0 ? inactive_task_timer+0x1ad/0x340 kmem_cache_free+0x357/0x560 inactive_task_timer+0x1ad/0x340 ? switched_from_dl+0x2d0/0x2d0 __run_hrtimer+0x8a/0x1a0 __hrtimer_run_queues+0x91/0x130 hrtimer_interrupt+0x10f/0x220 __sysvec_apic_timer_interrupt+0x7b/0xd0 sysvec_apic_timer_interrupt+0x4f/0xd0 ? asm_sysvec_apic_timer_interrupt+0xa/0x20 asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0033:0x7fff196bf6f5 Instead of calling __put_task_struct() directly, we defer it using call_rcu(). A more natural approach would use a workqueue, but since in PREEMPT_RT, we can't allocate dynamic memory from atomic context, the code would become more complex because we would need to put the work_struct instance in the task_struct and initialize it when we allocate a new task_struct. The issue is reproducible with stress-ng: while true; do stress-ng --sched deadline --sched-period 1000000000 \ --sched-runtime 800000000 --sched-deadline \ 1000000000 --mmapfork 23 -t 20 done Signed-off-by: Wander Lairson Costa Reported-by: Hu Chunyu Suggested-by: Oleg Nesterov Suggested-by: Valentin Schneider Suggested-by: Peter Zijlstra Cc: Sebastian Andrzej Siewior Cc: Paul McKenney Cc: Steven Rostedt Cc: Luis Goncalves --- include/linux/sched/task.h | 28 +++++++++++++++++++++++++++- kernel/fork.c | 8 ++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h index e0f5ac90a228..d20de91e3b95 100644 --- a/include/linux/sched/task.h +++ b/include/linux/sched/task.h @@ -118,10 +118,36 @@ static inline struct task_struct *get_task_struct(struct task_struct *t) } extern void __put_task_struct(struct task_struct *t); +extern void __put_task_struct_rcu_cb(struct rcu_head *rhp); static inline void put_task_struct(struct task_struct *t) { - if (refcount_dec_and_test(&t->usage)) + if (!refcount_dec_and_test(&t->usage)) + return; + + /* + * under PREEMPT_RT, we can't call put_task_struct + * in atomic context because it will indirectly + * acquire sleeping locks. + * + * call_rcu() will schedule delayed_put_task_struct_rcu() + * to be called in process context. + * + * __put_task_struct() is called when + * refcount_dec_and_test(&t->usage) succeeds. + * + * This means that it can't "conflict" with + * put_task_struct_rcu_user() which abuses ->rcu the same + * way; rcu_users has a reference so task->usage can't be + * zero after rcu_users 1 -> 0 transition. + * + * delayed_free_task() also uses ->rcu, but it is only called + * when it fails to fork a process. Therefore, there is no + * way it can conflict with put_task_struct(). + */ + if (IS_ENABLED(CONFIG_PREEMPT_RT) && !preemptible()) + call_rcu(&t->rcu, __put_task_struct_rcu_cb); + else __put_task_struct(t); } diff --git a/kernel/fork.c b/kernel/fork.c index 41c964104b58..5dce5ad3e410 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -988,6 +988,14 @@ void __put_task_struct(struct task_struct *tsk) } EXPORT_SYMBOL_GPL(__put_task_struct); +void __put_task_struct_rcu_cb(struct rcu_head *rhp) +{ + struct task_struct *task = container_of(rhp, struct task_struct, rcu); + + __put_task_struct(task); +} +EXPORT_SYMBOL_GPL(__put_task_struct_rcu_cb); + void __init __weak arch_task_cache_init(void) { } /*