linux-kernel - Re: workqueue: WARN at at kernel/workqueue.c:2176

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <538DC373.9@cn.fujitsu.com>
Date:	Tue, 3 Jun 2014 20:45:39 +0800
From:	Lai Jiangshan <laijs@...fujitsu.com>
To:	<jjherne@...ux.vnet.ibm.com>
CC:	Peter Zijlstra <peterz@...radead.org>,
	Sasha Levin <sasha.levin@...cle.com>,
	Tejun Heo <tj@...nel.org>, LKML <linux-kernel@...r.kernel.org>,
	Dave Jones <davej@...hat.com>, Ingo Molnar <mingo@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Steven Rostedt <rostedt@...dmis.org>
Subject: Re: workqueue: WARN at at kernel/workqueue.c:2176


Hi, Peter,

I rewrote the analyse. (scheduler_ipi() must be called before stopper-task,
so the part for workqueue of the old analyse maybe be wrong.)


I found something strange by review (just by review, no test yet)

int set_cpus_allowed_ptr(struct task_struct *p, const struct cpumask *new_mask)
{
...
	if (p->on_rq) {
		struct migration_arg arg = { p, dest_cpu };
		/* Need help from migration thread: drop lock and wait. */
		task_rq_unlock(rq, p, &flags);
		stop_one_cpu(cpu_of(rq), migration_cpu_stop, &arg);
		tlb_migrate_finish(p->mm);
		return 0;
	}
...
}

The branch failed to migrate a waken-up task with p->on_rq==0 if TTWU_QUEUE is enabled:
	p->wake_entry is added to the rq,
	p->state is TASK_WAKING
	p->on_rq is 0

In this case set_cpus_allowed_ptr() fails to migrate the waken-up task!!!.

Go back to workqueue for higher level analysing.

task1					task2					cpu#4
					wake_up_process(worker1)
					  ttwu_queue_remote() #queue worker1
					  to cpu#4
workqueue_cpu_up_callback(cpu=5)

set_cpus_allowed_ptr(worker1)
  set worker's cpuallowed to
  cpumask_of(5)
  see worker1->on_rq = 0,
  do not migrate it.
										scheduler_ipi()
										set worker1->on_rq = 1

										wq_worker_waking_up(worker1)
										fail to hit the WARN_ON()
										  due to WORKER_UNBOUND is not cleared.
set_cpus_allowed_ptr() return 0
clear WORKER_UNBOUND for worker1

In this case, the WARN_ON() in process_one_work() hit.

Thanks,
Lai


The following code maybe help.
---
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 268a45e..1a198a5 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4530,7 +4530,7 @@ int set_cpus_allowed_ptr(struct task_struct *p, const struct cpumask *new_mask)
 		goto out;
 
 	dest_cpu = cpumask_any_and(cpu_active_mask, new_mask);
-	if (p->on_rq) {
+	if (p->on_rq || p->state == TASK_WAKING) {
 		struct migration_arg arg = { p, dest_cpu };
 		/* Need help from migration thread: drop lock and wait. */
 		task_rq_unlock(rq, p, &flags);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/