linux-kernel - Re: Crash in fair scheduler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 3 Dec 2019 10:30:26 +0000
From:   Valentin Schneider <valentin.schneider@....com>
To:     "Schmid, Carsten" <Carsten_Schmid@...tor.com>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Crash in fair scheduler

On 03/12/2019 09:11, Schmid, Carsten wrote:
[...]

> set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
> {
> 	/* 'current' is not kept within the tree. */
> 	if (se->on_rq) { <<<<<<< crash here
> 
> set_next_entity is called from within pick_next_task_fair, from the following piece of code:
> static struct task_struct *
> pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
> {
> 	struct cfs_rq *cfs_rq = &rq->cfs;
> 	struct sched_entity *se;
> 	struct task_struct *p;
> 	int new_tasks;
> 
> again:
> 	if (!cfs_rq->nr_running) // this is 1, so we are not going to idle
> 		goto idle;
> 
> #ifdef CONFIG_FAIR_GROUP_SCHED
> 	if (prev->sched_class != &fair_sched_class) <<<<< this is true:
> 							crash> p &fair_sched_class
> 							$1 = (const struct sched_class *) 0xffffffffaaa10cc0 <<<<
> 							crash> $prev=ffff99a97895a580
> 							crash> gdb set $prev=(struct task_struct *)0xffff99a97895a580
> 							crash> p $prev->sched_class
> 							$2 = (const struct sched_class *) 0xffffffffaaa10b40 <<<<
> 		goto simple; <<<< so we go to simple
> ....
> (Line 6360, Kernel 4.14.86; Line 6820 Kernel v5.4-rc2)
> simple:
> #endif
> 
> 	put_prev_task(rq, prev);
> 
> 	do {
> 		se = pick_next_entity(cfs_rq, NULL); <<<< this returns se=NULL
> 		set_next_entity(cfs_rq, se); <<<<<<<< here we crash
> 		cfs_rq = group_cfs_rq(se);
> 	} while (cfs_rq);
> 
> So why is se = NULL returned?


That looks a lot like a recent issue we've had, see

  https://lore.kernel.org/lkml/20191108131909.428842459@infradead.org/

The issue is caused by
  
  67692435c411 ("sched: Rework pick_next_task() slow-path")

which 5.4-rc2 has (without the fix which landed in -rc7) but 4.14 really
shouldn't, unless the kernel you're using has had core scheduling somehow
backported to it?

I've only scraped the surface but I'd like to first ask: can you reproduce
the issue on v5.4 final ?

> Best regards
> Carsten
>