linux-kernel - Re: [RFC] Deadlock via recursive wakeup via RCU with threadirqs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190627204521.GA31499@linux.ibm.com>
Date:   Thu, 27 Jun 2019 13:45:21 -0700
From:   "Paul E. McKenney" <paulmck@...ux.ibm.com>
To:     Joel Fernandes <joel@...lfernandes.org>
Cc:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Steven Rostedt <rostedt@...dmis.org>,
        rcu <rcu@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Josh Triplett <josh@...htriplett.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Lai Jiangshan <jiangshanlai@...il.com>
Subject: Re: [RFC] Deadlock via recursive wakeup via RCU with threadirqs

On Thu, Jun 27, 2019 at 11:30:22AM -0700, Paul E. McKenney wrote:
> On Thu, Jun 27, 2019 at 11:11:12AM -0700, Paul E. McKenney wrote:
> > On Thu, Jun 27, 2019 at 01:46:27PM -0400, Joel Fernandes wrote:
> > > On Thu, Jun 27, 2019 at 1:43 PM Joel Fernandes <joel@...lfernandes.org> wrote:
> > > >
> > > > On Thu, Jun 27, 2019 at 11:40 AM Sebastian Andrzej Siewior
> > > > <bigeasy@...utronix.de> wrote:
> > > > >
> > > > > On 2019-06-27 11:37:10 [-0400], Joel Fernandes wrote:
> > > > > > Sebastian it would be nice if possible to trace where the
> > > > > > t->rcu_read_unlock_special is set for this scenario of calling
> > > > > > rcu_read_unlock_special, to give a clear idea about whether it was
> > > > > > really because of an IPI. I guess we could also add additional RCU
> > > > > > debug fields to task_struct (just for debugging) to see where there
> > > > > > unlock_special is set.
> > > > > >
> > > > > > Is there a test to reproduce this, or do I just boot an intel x86_64
> > > > > > machine with "threadirqs" and run into it?
> > > > >
> > > > > Do you want to send me a patch or should I send you my kvm image which
> > > > > triggers the bug on boot?
> > > >
> > > > I could reproduce this as well just booting Linus tree with threadirqs
> > > > command line and running rcutorture. In 15 seconds or so it locks
> > > > up... gdb backtrace shows the recursive lock:
> > > 
> > > Sorry that got badly wrapped, so I pasted it here:
> > > https://hastebin.com/ajivofomik.shell
> > 
> > Which rcutorture scenario would that be?  TREE03 is thus far refusing
> > to fail for me when run this way:
> > 
> > $ tools/testing/selftests/rcutorture/bin/kvm.sh --cpus 8 --duration 5 --trust-make --configs "TREE03" --bootargs "threadirqs"
> 
> Ah, but I was running -rcu.  TREE03 fails at 38 seconds for me on v5.2.
> 
> Now to find out which -rcu commit fixed it.  Or at least made it much
> less probable, to Sebastian's point.

And it still works before this one:

a69987a515c8 ("rcu: Simplify rcu_read_unlock_special() deferred wakeups")
	(This is included in the dev branch of the -rcu tree, and is
	currently slated for v5.4.)

And it works at these commits:

0864f057b050 ("rcu: Use irq_work to get scheduler's attention in clean context")
385b599e8c04 ("rcu: Allow rcu_read_unlock_special() to raise_softirq() if in_irq()")
25102de65fdd ("rcu: Only do rcu_read_unlock_special() wakeups if expedited")
23634ebc1d94 ("rcu: Check for wakeup-safe conditions in rcu_read_unlock_special()")
	I checked the last one twice, both completing without problems
	other than false positives due to security-induced pointer
	obfuscation.  (These will be included in my v5.3 pull request.)

But not at this commit:

48d07c04b4cc ("rcu: Enable elimination of Tree-RCU softirq processing")
	This gets RCU CPU stall warnings rather than the double wakeup
	of ksoftirqd.  Works fine without traceirqs.

v5.2-rc1 locks up hard at early boot (three of three attempts):

	[    2.525153] clocksource: Switched to clocksource tsc
	[    2.878858] random: fast init done
	[    2.881122] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input3
	[    2.884183] probe of serio1 returned 1 after 671008 usecs
	[    9.969474] hrtimer: interrupt took 3992554 ns

v5.1 gets the double wakeup of ksoftirqd.

So it looks like I need to get that pull request sent out, doesn't it?  ;-)

							Thanx, Paul