linux-kernel - Re: [PATCH] kthread: Prevent unpark race which puts threads on the wrong cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 12 Apr 2013 12:59:52 +0200 (CEST)
From:	Thomas Gleixner <tglx@...utronix.de>
To:	"Srivatsa S. Bhat" <srivatsa.bhat@...ux.vnet.ibm.com>
cc:	Borislav Petkov <bp@...en8.de>, Dave Hansen <dave@...1.net>,
	LKML <linux-kernel@...r.kernel.org>,
	Dave Jones <davej@...hat.com>, dhillf@...il.com,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...nel.org>
Subject: Re: [PATCH] kthread: Prevent unpark race which puts threads on the
 wrong cpu

Srivatsa,

On Fri, 12 Apr 2013, Srivatsa S. Bhat wrote:
> On 04/12/2013 02:17 AM, Thomas Gleixner wrote:
> >> +
> >> +	/*
> >> +	 * Wait for p->on_rq to be reset to 0, to ensure that the per-cpu
> >> +	 * migration thread (which belongs to the stop_task sched class)
> >> +	 * doesn't run until the cpu is actually onlined and the thread is
> >> +	 * unparked.
> >> +	 */
> >> +	if (!wait_task_inactive(p, TASK_INTERRUPTIBLE))
> >> +		WARN_ON(1);
> > 
> > Yay, we rely on TASK_INTERRUPTIBLE state with a task which already has
> > references outside the creation code.
> 
> I doubt that. We have not even onlined the CPU, how would any else even
> _know_ that we created this kthread??

The problem is not only at the thread creation time. We have the same
issue at offline/online and there we have a reference to that very
thread.
 
> >>  /**
> >>   * kthread_unpark - unpark a thread created by kthread_create().
> >>   * @k:		thread created by kthread_create().
> >> @@ -337,18 +357,29 @@ void kthread_unpark(struct task_struct *k)
> >>  	struct kthread *kthread = task_get_live_kthread(k);
> >>  
> >>  	if (kthread) {
> >> +		/*
> >> +		 * Per-cpu kthreads such as ksoftirqd can get woken up by
> >> +		 * other events. So after binding the thread, ensure that
> >> +		 * it goes off the CPU atleast once, by parking it again.
> >> +		 * This way, we can ensure that it will run on the correct
> >> +		 * CPU on subsequent wakeup.
> >> +		 */
> >> +		if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags)) {
> >> +			__kthread_bind(k, kthread->cpu);
> >> +			clear_bit(KTHREAD_IS_PARKED, &kthread->flags);
> > 
> > And how is that f*cking different from the previous code?
> > 
> > CPU0	   		CPU1		       CPU2
> > 				       	       wakeup(T) -> run on CPU1 (last cpu)
> > 
> > 			switch_to(T)
> > 
> > __kthread_bind(T, CPU2)
> > 
> > clear(KTHREAD_IS_PARKED)
> > 
> > 			leave loop due to !KTHREAD_IS_PARKED
> 
> 			How?? The task will leave the loop only when we clear
> 			SHOULD_PARK, not when we clear IS_PARKED. So it won't
> 			leave the loop here. It will cause the kthread to
> 			perform a fresh complete() for the waiting kthread_park()
> 			on CPU0.

You are right on that, but you tricked me into misreading your
patch. Why? Simply because it is too complex for no reason.

> No, the purpose of clear(IS_PARKED) followed by __kthread_park() is to
> ensure that the task gets *descheduled* atleast once after we did the
> kthread_bind(). And that's because we can't use set_cpus_allowed_ptr() to
> migrate a running kthread (because the kthread could be the migration
> thread). So instead, we use kthread_bind() and depend on sleep->wakeup
> to put the task on the right CPU.

Yeah, it's a nice workaround, though I really prefer a guaranteed well
defined state over this wakeup/sleep/wakeup trickery, which also adds
the additional cost of a wakeup/sleep cycle to the online operation.

> > TASK_PARKED is the very obvious and robust solution which fixes _ALL_
> > of the corner cases, at least as far as I can imagine them. And
> > robustness rules at least in my world.
> > 
> 
> Yes, I agree that it is robust and has clear semantics. No doubt about
> that. So I won't insist on going with my suggestions.

I'm glad, that we can agree on the robust solution :)

Thanks,

	tglx
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/