linux-kernel - Re: Lockdep splat from destroy_workqueue() with RT_PREEMPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 8 Dec 2016 16:25:44 +0000
From:   John Keeping <john@...anate.com>
To:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc:     linux-kernel@...r.kernel.org, Tejun Heo <tj@...nel.org>,
        Lai Jiangshan <jiangshanlai@...il.com>,
        linux-rt-users@...r.kernel.org,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: Lockdep splat from destroy_workqueue() with RT_PREEMPT_FULL

Hi Sebastian,

On Thu, 8 Dec 2016 14:33:06 +0100, Sebastian Andrzej Siewior wrote:
> On 2016-12-08 12:20:28 [+0000], John Keeping wrote:
> > I am seeing the following splat when stopping btattach on v4.4.30-rt41
> > with PREEMPT_RT_FULL with lockdep and slub_debug.
> > 
> > The bad unlock balance seems to just be an effect of the lock having
> > been overwritten with POISON_FREE, the real issue is that
> > put_pwq_unlocked() is not resuming and unlocking the pool before the RCU
> > work scheduled indirectly by put_pwq() has completed.  
> 
> can you reproduce this? If so, is this patch helping?

Yes, I am able to reproduce it reasonably reliably, or at least I *was*
able to: since applying the patch below I haven't seen it fail at all,
so consider the patch:

Tested-by: John Keeping <john@...anate.com>


> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> --- a/kernel/workqueue.c
> +++ b/kernel/workqueue.c
> @@ -1135,9 +1135,11 @@ static void put_pwq_unlocked(struct pool_workqueue *pwq)
>  		 * As both pwqs and pools are RCU protected, the
>  		 * following lock operations are safe.
>  		 */
> +		rcu_read_lock();
>  		local_spin_lock_irq(pendingb_lock, &pwq->pool->lock);
>  		put_pwq(pwq);
>  		local_spin_unlock_irq(pendingb_lock, &pwq->pool->lock);
> +		rcu_read_unlock();
>  	}
>  }


John