| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20210212003032.2037750-1-aklimov@redhat.com>
Date: Fri, 12 Feb 2021 00:30:32 +0000
From: Alexey Klimov <aklimov@...hat.com>
To: linux-kernel@...r.kernel.org, cgroups@...r.kernel.org
Cc: peterz@...radead.org, yury.norov@...il.com,
daniel.m.jordan@...cle.com, tglx@...utronix.de, jobaker@...hat.com,
audralmitchel@...il.com, arnd@...db.de, gregkh@...uxfoundation.org,
rafael@...nel.org, tj@...nel.org, qais.yousef@....com,
hannes@...xchg.org, klimov.linux@...il.com
Subject: [PATCH v2] cpu/hotplug: wait for cpuset_hotplug_work to finish on cpu onlining
When a CPU offlined and onlined via device_offline() and device_online()
the userspace gets uevent notification. If, after receiving "online" uevent,
userspace executes sched_setaffinity() on some task trying to move it
to a recently onlined CPU, then it often fails with -EINVAL. Userspace needs
to wait around 5..30 ms before sched_setaffinity() will succeed for recently
onlined CPU after receiving uevent.
If in_mask argument for sched_setaffinity() has only recently onlined CPU,
it often fails with such flow:
sched_setaffinity()
cpuset_cpus_allowed()
guarantee_online_cpus() <-- cs->effective_cpus mask does not
contain recently onlined cpu
cpumask_and() <-- final new_mask is empty
__set_cpus_allowed_ptr()
cpumask_any_and_distribute() <-- returns dest_cpu equal to nr_cpu_ids
returns -EINVAL
Cpusets used in guarantee_online_cpus() are updated using workqueue from
cpuset_update_active_cpus() which in its turn is called from cpu hotplug callback
sched_cpu_activate() hence it may not be observable by sched_setaffinity() if
it is called immediately after uevent.
Out of line uevent can be avoided if we will ensure that cpuset_hotplug_work
has run to completion using cpuset_wait_for_hotplug() after onlining the
cpu in cpu_device_up() and in cpuhp_smt_enable().
Co-analyzed-by: Joshua Baker <jobaker@...hat.com>
Signed-off-by: Alexey Klimov <aklimov@...hat.com>
---
Previous patches and discussion are:
RFC patch: https://lore.kernel.org/lkml/20201203171431.256675-1-aklimov@redhat.com/
v1 patch: https://lore.kernel.org/lkml/20210204010157.1823669-1-aklimov@redhat.com/
The commit a49e4629b5ed "cpuset: Make cpuset hotplug synchronous"
would also get rid of the early uevent but it was reverted (deadlocks).
The nature of this bug is also described here (with different consequences):
https://lore.kernel.org/lkml/20200211141554.24181-1-qais.yousef@arm.com/
Reproducer: https://gitlab.com/0xeafffffe/xlam
Currently with such changes the reproducer code continues to work without issues.
The idea is to avoid the situation when userspace receives the event about
onlined CPU which is not ready to take tasks for a while after uevent.
kernel/cpu.c | 79 +++++++++++++++++++++++++++++++++++++---------------
1 file changed, 56 insertions(+), 23 deletions(-)
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 4e11e91010e1..8817ccdc8e11 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -15,6 +15,7 @@
#include <linux/sched/smt.h>
#include <linux/unistd.h>
#include <linux/cpu.h>
+#include <linux/cpuset.h>
#include <linux/oom.h>
#include <linux/rcupdate.h>
#include <linux/export.h>
@@ -1294,7 +1295,17 @@ static int cpu_up(unsigned int cpu, enum cpuhp_state target)
*/
int cpu_device_up(struct device *dev)
{
- return cpu_up(dev->id, CPUHP_ONLINE);
+ int err;
+
+ err = cpu_up(dev->id, CPUHP_ONLINE);
+ /*
+ * Wait for cpuset updates to cpumasks to finish. Later on this path
+ * may generate uevents whose consumers rely on the updates.
+ */
+ if (!err)
+ cpuset_wait_for_hotplug();
+
+ return err;
}
int add_cpu(unsigned int cpu)
@@ -2057,28 +2068,16 @@ void __cpuhp_remove_state(enum cpuhp_state state, bool invoke)
EXPORT_SYMBOL(__cpuhp_remove_state);
#ifdef CONFIG_HOTPLUG_SMT
-static void cpuhp_offline_cpu_device(unsigned int cpu)
-{
- struct device *dev = get_cpu_device(cpu);
-
- dev->offline = true;
- /* Tell user space about the state change */
- kobject_uevent(&dev->kobj, KOBJ_OFFLINE);
-}
-
-static void cpuhp_online_cpu_device(unsigned int cpu)
-{
- struct device *dev = get_cpu_device(cpu);
-
- dev->offline = false;
- /* Tell user space about the state change */
- kobject_uevent(&dev->kobj, KOBJ_ONLINE);
-}
-
int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
{
- int cpu, ret = 0;
+ struct device *dev;
+ cpumask_var_t mask;
+ int cpu, ret;
+
+ if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+ return -ENOMEM;
+ ret = 0;
cpu_maps_update_begin();
for_each_online_cpu(cpu) {
if (topology_is_primary_thread(cpu))
@@ -2099,18 +2098,35 @@ int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
* called under the sysfs hotplug lock, so it is properly
* serialized against the regular offline usage.
*/
- cpuhp_offline_cpu_device(cpu);
+ dev = get_cpu_device(cpu);
+ dev->offline = true;
+
+ cpumask_set_cpu(cpu, mask);
}
if (!ret)
cpu_smt_control = ctrlval;
cpu_maps_update_done();
+
+ /* Tell user space about the state changes */
+ for_each_cpu(cpu, mask) {
+ dev = get_cpu_device(cpu);
+ kobject_uevent(&dev->kobj, KOBJ_OFFLINE);
+ }
+
+ free_cpumask_var(mask);
return ret;
}
int cpuhp_smt_enable(void)
{
- int cpu, ret = 0;
+ struct device *dev;
+ cpumask_var_t mask;
+ int cpu, ret;
+
+ if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+ return -ENOMEM;
+ ret = 0;
cpu_maps_update_begin();
cpu_smt_control = CPU_SMT_ENABLED;
for_each_present_cpu(cpu) {
@@ -2121,9 +2137,26 @@ int cpuhp_smt_enable(void)
if (ret)
break;
/* See comment in cpuhp_smt_disable() */
- cpuhp_online_cpu_device(cpu);
+ dev = get_cpu_device(cpu);
+ dev->offline = false;
+
+ cpumask_set_cpu(cpu, mask);
}
cpu_maps_update_done();
+
+ /*
+ * Wait for cpuset updates to cpumasks to finish. Later on this path
+ * may generate uevents whose consumers rely on the updates.
+ */
+ cpuset_wait_for_hotplug();
+
+ /* Tell user space about the state changes */
+ for_each_cpu(cpu, mask) {
+ dev = get_cpu_device(cpu);
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
+ free_cpumask_var(mask);
return ret;
}
#endif
--
2.30.0
Powered by blists - more mailing lists