linux-kernel - Re: [RFC] Deadlock via recursive wakeup via RCU with threadirqs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20190628182325.GZ26519@linux.ibm.com>
Date:   Fri, 28 Jun 2019 11:23:25 -0700
From:   "Paul E. McKenney" <paulmck@...ux.ibm.com>
To:     Joel Fernandes <joel@...lfernandes.org>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        rcu <rcu@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Josh Triplett <josh@...htriplett.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Lai Jiangshan <jiangshanlai@...il.com>
Subject: Re: [RFC] Deadlock via recursive wakeup via RCU with threadirqs

On Fri, Jun 28, 2019 at 02:05:37PM -0400, Joel Fernandes wrote:
> On Fri, Jun 28, 2019 at 10:30:11AM -0700, Paul E. McKenney wrote:
> > On Fri, Jun 28, 2019 at 12:45:59PM -0400, Joel Fernandes wrote:
> > > On Fri, Jun 28, 2019 at 12:40:08PM -0400, Joel Fernandes wrote:
> > > > On Thu, Jun 27, 2019 at 11:41:07AM -0700, Paul E. McKenney wrote:
> > > > [snip]
> > > > > > > > And we should document this somewhere for future sanity preservation
> > > > > > > > :-D
> > > > > > > 
> > > > > > > Or adjust the code and requirements to make it more sane, if feasible.
> > > > > > > 
> > > > > > > My current (probably wildly unreliable) guess that the conditions in
> > > > > > > rcu_read_unlock_special() need adjusting.  I was assuming that in_irq()
> > > > > > > implies a hardirq context, in other words that in_irq() would return
> > > > > > > false from a threaded interrupt handler.  If in_irq() instead returns
> > > > > > > true from within a threaded interrupt handler, then this code in
> > > > > > > rcu_read_unlock_special() needs fixing:
> > > > > > > 
> > > > > > > 		if ((exp || in_irq()) && irqs_were_disabled && use_softirq &&
> > > > > > > 		    (in_irq() || !t->rcu_read_unlock_special.b.deferred_qs)) {
> > > > > > > 			// Using softirq, safe to awaken, and we get
> > > > > > > 			// no help from enabling irqs, unlike bh/preempt.
> > > > > > > 			raise_softirq_irqoff(RCU_SOFTIRQ);
> > > > > > > 
> > > > > > > The fix would be replacing the calls to in_irq() with something that
> > > > > > > returns true only if called from within a hardirq context.
> > > > > > > Thoughts?
> > > > > > 
> > > > > > I am not sure if this will fix all cases though?
> > > > > > 
> > > > > > I think the crux of the problem is doing a recursive wake up. The threaded
> > > > > > IRQ probably just happens to be causing it here, it seems to me this problem
> > > > > > can also occur on a non-threaded irq system (say current_reader() in your
> > > > > > example executed in a scheduler path in process-context and not from an
> > > > > > interrupt). Is that not possible?
> > > > > 
> > > > > In the non-threaded case, invoking raise_softirq*() from hardirq context
> > > > > just sets a bit in a per-CPU variable.  Now, to Sebastian's point, we
> > > > > are only sort of in hardirq context in this case due to being called
> > > > > from irq_exit(), but the failure we are seeing might well be a ways
> > > > > downstream of the actual root-cause bug.
> > > > 
> > > > Hi Paul,
> > > > I was talking about calling of rcu_read_unlock_special from a normal process
> > > > context from the scheduler.
> > > > 
> > > > In the below traces, it shows that only the PREEMPT_MASK offset is set at the
> > > > time of the issue. Both HARD AND SOFT IRQ masks are not enabled, which means
> > > > the lock up is from a normal process context.
> > > > 
> > > > I think I finally understood why the issue shows up only with threadirqs in
> > > > my setup. If I build x86_64_defconfig, the CONFIG_IRQ_FORCED_THREADING=y
> > > > option is set. And booting this with threadirqs, it always tries to
> > > > wakeup_ksoftirqd in invoke_softirq.
> > > > 
> > > > I believe what happens is, at an in-opportune time when the .blocked field is
> > > > set for the preempted task, an interrupt is received. This timing is quite in
> > > > auspicious because t->rcu_read_unlock_special just happens to have its
> > > > .blocked field set even though it is not in a reader-section.
> > 
> > Thank you for tracing through this!
> 
> My pleasure ;)
> 
> > > I believe the .blocked field remains set even though we are not any more in a
> > > reader section because of deferred processing of the blocked lists that you
> > > mentioned yesterday.
> > 
> > That can indeed happen.  However, in current -rcu, that would mean
> > that .deferred_qs is also set, which (if in_irq()) would prevent
> > the raise_softirq_irqsoff() from being invoked.  Which was why I was
> > asking the questions about whether in_irq() returns true within threaded
> > interrupts yesterday.  If it does, I need to find if there is some way
> > of determining whether rcu_read_unlock_special() is being called from
> > a threaded interrupt in order to suppress the call to raise_softirq()
> > in that case.
> 
> Thanks. I will take a look at the -rcu tree a bit and reply to this.
> 
> > But which version of the kernel are you using here?  Current -rcu?
> > v5.2-rc1?  Something else?
> 
> This is v5.2-rc6 kernel version from Linus tree which was showing the issue.

OK, that version does not contain the alleged fixes that are in -rcu.

							Thanx, Paul