Date:	Thu, 24 Sep 2015 01:59:58 +0200
From:	Sedat Dilek <sedat.dilek@...il.com>
To:	Lai Jiangshan <jiangshanlai@...il.com>
Cc:	Tejun Heo <tj@...nel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [Linux v4.2] workqueue: llvmlinux: acpid: BUG: sleeping function
 called from invalid context at kernel/workqueue.c:2680

On Thu, Sep 10, 2015 at 3:04 AM, Lai Jiangshan <jiangshanlai@...il.com> wrote:
> Hi, TJ
>
> I think we need to add might_sleep() on the top of __cancel_work_timer().
> The might_sleep() on the start_flush_work() doesn't cover all the
> paths of __cancel_work_timer().
> And it can help to narrow the area of this bug.
>

I moved the might_sleep() from start_flush_work() to
__cancel_work_timer() (see attached patch).

[   23.444152] BUG: sleeping function called from invalid context at
kernel/workqueue.c:2767
[   23.444217] in_atomic(): 0, irqs_disabled(): 1, pid: 1423, name: acpid
[   23.444265] 3 locks held by acpid/1423:
[   23.444266]  #0:  (&evdev->mutex){+.+...}, at: [<ffffffff8174a2bc>]
evdev_release+0xbc/0xf0
[   23.444276]  #1:  (&dev->mutex#2){+.+...}, at: [<ffffffff817419d7>]
input_close_device+0x27/0x70
[   23.444283]  #2:  (hid_open_mut){+.+...}, at: [<ffffffffa011a388>]
usbhid_close+0x28/0xb0 [usbhid]
[   23.444291] irq event stamp: 7850
[   23.444293] hardirqs last  enabled at (7849): [<ffffffff8192a2b2>]
_raw_spin_unlock_irq+0x32/0x60
[   23.444298] hardirqs last disabled at (7850): [<ffffffff81120e37>]
del_timer_sync+0x37/0x110
[   23.444303] softirqs last  enabled at (7164): [<ffffffff818b06a9>]
local_bh_enable+0x9/0x20
[   23.444307] softirqs last disabled at (7162): [<ffffffff818b0689>]
local_bh_disable+0x9/0x20
[   23.444312] CPU: 2 PID: 1423 Comm: acpid Not tainted
4.3.0-rc2-3-llvmlinux-amd64 #2
[   23.444314] Hardware name: SAMSUNG ELECTRONICS CO., LTD.
530U3BI/530U4BI/530U4BH/530U3BI/530U4BI/530U4BH, BIOS 13XK 03/28/2013
[   23.444316]  ffff8800d2e82948 0000000000000096 0000000000000000
ffff8800bcc4fbf8
[   23.444320]  ffffffff8149a4ad ffff8800bcc4fc28 ffffffff810cd53a
ffffffff81c56fcc
[   23.444324]  ffff8800c69f0040 0000000000000000 0000000000000acf
ffff8800bcc4fc68
[   23.444328] Call Trace:
[   23.444332]  [<ffffffff8149a4ad>] dump_stack+0x7d/0xa0
[   23.444336]  [<ffffffff810cd53a>] ___might_sleep+0x28a/0x2a0
[   23.444338]  [<ffffffff810cd23f>] __might_sleep+0x4f/0xc0
[   23.444342]  [<ffffffff810b01de>] __cancel_work_timer+0x2e/0x270
[   23.444345]  [<ffffffff8192a252>] ? _raw_spin_unlock_irqrestore+0x52/0x80
[   23.444348]  [<ffffffff81120ded>] ? try_to_del_timer_sync+0xad/0xc0
[   23.444351]  [<ffffffff810b01a8>] cancel_work_sync+0x18/0x20
[   23.444354]  [<ffffffffa011a3d5>] usbhid_close+0x75/0xb0 [usbhid]
[   23.444360]  [<ffffffffa00d44d1>] hidinput_close+0x31/0x40 [hid]
[   23.444364]  [<ffffffffa00d44a0>] ? hidinput_open+0x40/0x40 [hid]
[   23.444367]  [<ffffffff817419f8>] input_close_device+0x48/0x70
[   23.444370]  [<ffffffff8174a2d6>] evdev_release+0xd6/0xf0
[   23.444373]  [<ffffffff81271dc7>] __fput+0x107/0x240
[   23.444375]  [<ffffffff81271c56>] ____fput+0x16/0x20
[   23.444378]  [<ffffffff810b979c>] task_work_run+0x6c/0xe0
[   23.444383]  [<ffffffff81003b8a>] prepare_exit_to_usermode+0x13a/0x140
[   23.444386]  [<ffffffff81003e11>] syscall_return_slowpath+0x281/0x2f0
[   23.444389]  [<ffffffff8126e4a5>] ? filp_close+0x65/0x90
[   23.444392]  [<ffffffff81003017>] ? trace_hardirqs_on_thunk+0x17/0x19
[   23.444396]  [<ffffffff8192afe2>] int_ret_from_sys_call+0x25/0x9f

Can you look at this?

- Sedat -

> Hi Sedat Dilek
>
> [   24.705704] irq event stamp: 19968
> [   24.705706] hardirqs last  enabled at (19967): [<ffffffff81917ff2>]
> _raw_spin_unlock_irq+0x32/0x60
> [   24.705713] hardirqs last disabled at (19968): [<ffffffff81120477>]
> del_timer_sync+0x37/0x110
>
> Is it means the irq-disabled-event is leak by del_timer_sync()? It is
> impossible.
>
> usbhid_close()
>   mutex_lock(); // it has might_sleep() check. So the problem seems to be
>                 // hidden at one of the following statements
>   del_timer_sync();
>   cancel_work_sync();
>
>
> On Wed, Sep 9, 2015 at 6:24 PM, Sedat Dilek <sedat.dilek@...il.com> wrote:
>> [ TO WORKQUEUE maintainers ]
>>
>> Hi,
>>
>> I encountered a BUG with a llvmlinux compiled kernel here on
>> Ubuntu/precise AMD64 touching the workqueue area.
>>
>> [   24.705463] BUG: sleeping function called from invalid context at
>> kernel/workqueue.c:2680
>> [   24.705576] in_atomic(): 0, irqs_disabled(): 1, pid: 1447, name: acpid
>> [   24.705662] 3 locks held by acpid/1447:
>> [   24.705664]  #0:  (&evdev->mutex){+.+...}, at: [<ffffffff8173b9ac>]
>> evdev_release+0xbc/0xf0
>> [   24.705678]  #1:  (&dev->mutex#2){+.+...}, at: [<ffffffff81733117>]
>> input_close_device+0x27/0x70
>> [   24.705691]  #2:  (hid_open_mut){+.+...}, at: [<ffffffffa0056378>]
>> usbhid_close+0x28/0xb0 [usbhid]
>> [   24.705704] irq event stamp: 19968
>> [   24.705706] hardirqs last  enabled at (19967): [<ffffffff81917ff2>]
>> _raw_spin_unlock_irq+0x32/0x60
>> [   24.705713] hardirqs last disabled at (19968): [<ffffffff81120477>]
>> del_timer_sync+0x37/0x110
>> [   24.705720] softirqs last  enabled at (18890): [<ffffffff8189e7c9>]
>> local_bh_enable+0x9/0x20
>> [   24.705726] softirqs last disabled at (18888): [<ffffffff8189e7a9>]
>> local_bh_disable+0x9/0x20
>> [   24.705734] CPU: 2 PID: 1447 Comm: acpid Not tainted
>> 4.2.0-2-llvmlinux-small #2
>> [   24.705737] Hardware name: SAMSUNG ELECTRONICS CO., LTD.
>> 530U3BI/530U4BI/530U4BH/530U3BI/530U4BI/530U4BH, BIOS 13XK 03/28/2013
>> [   24.705741]  ffff8800d57ea948 0000000000000092 0000000000000000
>> ffff8800bb3e3aa8
>> [   24.705748]  ffffffff8149287d ffff8800bb3e3ad8 ffffffff810cbf7a
>> ffffffff81c51a34
>> [   24.705754]  ffff8800d3095000 0000000000000000 0000000000000a78
>> ffff8800bb3e3b18
>> [   24.705761] Call Trace:
>> [   24.705767]  [<ffffffff8149287d>] dump_stack+0x7d/0xa0
>> [   24.705774]  [<ffffffff810cbf7a>] ___might_sleep+0x28a/0x2a0
>> [   24.705779]  [<ffffffff810cbc7f>] __might_sleep+0x4f/0xc0
>> [   24.705784]  [<ffffffff810ae8ff>] start_flush_work+0x2f/0x290
>> [   24.705789]  [<ffffffff810ae8ac>] flush_work+0x5c/0x80
>> [   24.705792]  [<ffffffff810ae86a>] ? flush_work+0x1a/0x80
>> [   24.705799]  [<ffffffff810eddcd>] ? trace_hardirqs_off+0xd/0x10
>> [   24.705804]  [<ffffffff810ad938>] ? try_to_grab_pending+0x48/0x360
>> [   24.705810]  [<ffffffff81917e13>] ? _raw_spin_lock_irqsave+0x73/0x80
>> [   24.705814]  [<ffffffff810aecf9>] __cancel_work_timer+0x179/0x260
>> [   24.705820]  [<ffffffff81917f92>] ? _raw_spin_unlock_irqrestore+0x52/0x80
>> [   24.705825]  [<ffffffff8112042d>] ? try_to_del_timer_sync+0xad/0xc0
>> [   24.705829]  [<ffffffff810aeb78>] cancel_work_sync+0x18/0x20
>> [   24.705835]  [<ffffffffa00563c5>] usbhid_close+0x75/0xb0 [usbhid]
>> [   24.705844]  [<ffffffffa0039431>] hidinput_close+0x31/0x40 [hid]
>> [   24.705851]  [<ffffffffa0039400>] ? hidinput_open+0x40/0x40 [hid]
>> [   24.705856]  [<ffffffff81733138>] input_close_device+0x48/0x70
>> [   24.705861]  [<ffffffff8173b9c6>] evdev_release+0xd6/0xf0
>> [   24.705867]  [<ffffffff8126ed37>] __fput+0x107/0x240
>> [   24.705872]  [<ffffffff8126ebc6>] ____fput+0x16/0x20
>> [   24.705877]  [<ffffffff810b8107>] task_work_run+0x87/0x130
>> [   24.705883]  [<ffffffff810173ef>] do_notify_resume+0x9cf/0xa00
>> [   24.705888]  [<ffffffff810edddd>] ? trace_hardirqs_on+0xd/0x10
>> [   24.705895]  [<ffffffff811d1cc3>] ? context_tracking_user_enter+0x13/0x20
>> [   24.705900]  [<ffffffff81029c31>] ? syscall_trace_leave+0x111/0x340
>> [   24.705905]  [<ffffffff8126eb56>] ? fput+0x76/0xd0
>> [   24.705909]  [<ffffffff8126b415>] ? filp_close+0x65/0x90
>> [   24.705915]  [<ffffffff81003017>] ? trace_hardirqs_on_thunk+0x17/0x19
>> [   24.705920]  [<ffffffff81918dae>] int_signal+0x12/0x17
>>
>> Attached are the full dmesg-log and my kernel-config.
>>
>> Which area in the kernel is the root cause? CC more people?
>>
>> Do you need more informations?
>> How can I help?
>>
>> Regards,
>> - Sedat -

View attachment "0001-workqueue-Move-might_sleep-from-start_flush_work-to-.patch" of type "text/x-patch" (953 bytes)

Powered by blists - more mailing lists