linux-kernel - Re: [PATCH v2] sched/fair: Fix dereference NULL sched domain during select_idle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 17 Oct 2016 13:29:05 +0200
From:   Petr Mladek <pmladek@...e.com>
To:     Wanpeng Li <kernellwp@...il.com>
Cc:     linux-kernel@...r.kernel.org, Wanpeng Li <wanpeng.li@...mail.com>,
        Ingo Molnar <mingo@...nel.org>, Mike Galbraith <efault@....de>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH v2] sched/fair: Fix dereference NULL sched domain during
 select_idle_sibling

On Sun 2016-10-09 08:04:03, Wanpeng Li wrote:
> From: Wanpeng Li <wanpeng.li@...mail.com>
> 
> Commit:
> 
>   10e2f1acd01 ("sched/core: Rewrite and improve select_idle_siblings()")
> 
> ... improved select_idle_sibling() but also triggered a regression:
> 
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000078
> IP: [<ffffffffb10cd332>] select_idle_sibling+0x1c2/0x4f0
> PGD 0 
> Oops: 0000 [#1] SMP
> CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.8.0+ #16
> RIP: 0010:[<ffffffffb10cd332>]  [<ffffffffb10cd332>] select_idle_sibling+0x1c2/0x4f0
> Call Trace:
>  <IRQ> 
>   select_task_rq_fair+0x749/0x930
>   ? select_task_rq_fair+0xb4/0x930
>   ? __lock_is_held+0x54/0x70
>   try_to_wake_up+0x19a/0x5b0
>   default_wake_function+0x12/0x20
>   autoremove_wake_function+0x12/0x40
>   __wake_up_common+0x55/0x90
>   __wake_up+0x39/0x50
>   wake_up_klogd_work_func+0x40/0x60
>   irq_work_run_list+0x57/0x80
>   irq_work_run+0x2c/0x30
>   smp_irq_work_interrupt+0x2e/0x40
>   irq_work_interrupt+0x96/0xa0
>  <EOI> 
>   ? _raw_spin_unlock_irqrestore+0x45/0x80
>   try_to_wake_up+0x4a/0x5b0
>   wake_up_state+0x10/0x20
>   __kthread_unpark+0x67/0x70
>   kthread_unpark+0x22/0x30
>   cpuhp_online_idle+0x3e/0x70
>   cpu_startup_entry+0x6a/0x450
>   start_secondary+0x154/0x180
> 
> This can be reproduced by running the ftrace test case of kselftest, the 
> test case will hot-unplug the cpu and the cpu will attach to the NULL 
> sched-domain during scheduler teardown. 
> 
> The step 2 for the rewrite select_idle_siblings():
> 
> | Step 2) tracks the average cost of the scan and compares this to the
> | average idle time guestimate for the CPU doing the wakeup.
> 
> If the cpu which doing the wakeup is the going hot-unplug cpu, then NULL
> sched domain will be dereferenced to acquire the average cost of the scan.
> 
> This patch fix it by failing the search of an idle CPU in the LLC process 
> if this sched domain is NULL.
> 
> Cc: Ingo Molnar <mingo@...nel.org>
> Cc: Mike Galbraith <efault@....de>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Signed-off-by: Wanpeng Li <wanpeng.li@...mail.com>

This patch helped me as well. I tested intel_powerclamp
conversion to the new CPU hotplug state machine. And this
problem was very easy to trigger.

Feel free to add

Tested-by: Petr Mladek <pmladek@...e.com>

Best Regards,
Petr