linux-kernel - Re: WARNING: at arch/x86_64/kernel/smp.c:397 smp_call_function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20070928020950.bdcad2c2.akpm@linux-foundation.org>
Date:	Fri, 28 Sep 2007 02:09:50 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Laurent Vivier <Laurent.Vivier@...l.net>
Cc:	Fengguang Wu <wfg@...l.ustc.edu.cn>, Andi Kleen <ak@...e.de>,
	linux-kernel@...r.kernel.org
Subject: Re: WARNING: at arch/x86_64/kernel/smp.c:397
 smp_call_function_mask()

On Fri, 28 Sep 2007 10:52:08 +0200 Laurent Vivier <Laurent.Vivier@...l.net> wrote:

> Fengguang Wu wrote:
> > On Thu, Sep 27, 2007 at 02:22:20AM -0700, Andrew Morton wrote:
> >> ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.23-rc8/2.6.23-rc8-mm2/
> >  
> > Laurent,
> > 
> > It triggered a WARNING on first run in qemu:
> 
> Thank you to report it.
> 
> > 
> > [    0.310000] WARNING: at arch/x86_64/kernel/smp.c:397 smp_call_function_mask()
> > [    0.310000]
> > [    0.310000] Call Trace:
> > [    0.310000]  [<ffffffff8100dbde>] dump_trace+0x3ee/0x4a0
> > [    0.310000]  [<ffffffff8100dcd3>] show_trace+0x43/0x70
> > [    0.310000]  [<ffffffff8100dd15>] dump_stack+0x15/0x20
> > [    0.310000]  [<ffffffff8101cd44>] smp_call_function_mask+0x94/0xa0
> > [    0.310000]  [<ffffffff8101cd69>] smp_call_function+0x19/0x20
> > [    0.310000]  [<ffffffff8104277f>] on_each_cpu+0x1f/0x50
> > [    0.310000]  [<ffffffff81026eac>] global_flush_tlb+0x8c/0x110
> > [    0.310000]  [<ffffffff81025c85>] free_init_pages+0xe5/0xf0
> > [    0.310000]  [<ffffffff81549b5e>] alternative_instructions+0x7e/0x150
> > [    0.310000]  [<ffffffff8154a2ea>] check_bugs+0x1a/0x20
> > [    0.310000]  [<ffffffff81540c4a>] start_kernel+0x2da/0x380
> > [    0.310000]  [<ffffffff81540132>] _sinittext+0x132/0x140
> 
> 
> the reason is the WARN_ON():
> 
> 390 int smp_call_function_mask(cpumask_t mask,
> 391                            void (*func)(void *), void *info,
> 392                            int wait)
> 393 {
> 394         int ret;
> 395
> 396         /* Can deadlock when called with interrupts disabled */
> 397         WARN_ON(irqs_disabled());
> 398
> 399         spin_lock(&call_lock);
> 400         ret = __smp_call_function_mask(mask, func, info, wait);
> 401         spin_unlock(&call_lock);
> 402         return ret;
> 403 }
> 
> The patch I sent to Andi didn't include this WARN_ON() and it's why I didn't
> find this issue. (see http://lkml.org/lkml/2007/8/24/101)
> 
> smp_call_function_mask() is called by smp_call_function() which calls a function
> on all CPU except current.
> The comment of smp_call_function() specifies:
> ...
>  * You must not call this function with disabled interrupts or from a
>  * hardware interrupt handler or from a bottom half handler.
>  * Actually there are a few legal cases, like panic.
>  */
> 
> So this WARN_ON() is correct, and the caller (global_flush_tlb()) doesn't follow
> this rule.
> 
> I guess this WARN_ON() is only needed when we have current CPU in provided mask.
> So I think we should change:
> 
> int smp_call_function (void (*func) (void *info), void *info, int nonatomic,
>                         int wait)
> {
>         return smp_call_function_mask(cpu_online_map, func, info, wait);
> }
> ("cpu_online_map" is a bad choice, comment also specifies: "run a function on
> all other CPU")
> 
> to
> 
> int smp_call_function (void (*func) (void *info), void *info, int nonatomic,
>                         int wait)
> {
>         int ret;
> 	cpumask_t allbutself;
> 
> 	allbutself = cpu_online_map;
> 	cpu_clear(smp_processor_id(), allbutself);
> 
>         spin_lock(&call_lock);
>         ret = __smp_call_function_mask(allbutself, func, info, wait);
>         spin_unlock(&call_lock);
>         return ret;
> }
> (which is smp_call_function_mask() without the WARN_ON() and without current cpu
> in the mask)
> 
> Andi, is this correct ?
> Andrew, should I send a patch implementing this change ?

umm, I think all the smp_call_function fucntions are deadlocky if called
with local interrupts disabled, regardless of whether the calling CPU is in
the mask.

If CPU A is sending a cross-cpu call to CPU B and CPU B is sending a
cross-cpu call to CPU A, and they both have local interrupts disabled...

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/