linux-kernel - Re: [PATCH v8 01/13] rcu: Fix missing nocb gp wake on rcu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Oct 2022 08:03:44 -0700
From:   "Paul E. McKenney" <paulmck@...nel.org>
To:     Frederic Weisbecker <frederic@...nel.org>
Cc:     "Joel Fernandes (Google)" <joel@...lfernandes.org>,
        rcu@...r.kernel.org, linux-kernel@...r.kernel.org,
        rushikesh.s.kadam@...el.com, urezki@...il.com,
        neeraj.iitr10@...il.com, rostedt@...dmis.org,
        youssefesmat@...gle.com, surenb@...gle.com
Subject: Re: [PATCH v8 01/13] rcu: Fix missing nocb gp wake on rcu_barrier()

On Fri, Oct 14, 2022 at 04:40:19PM +0200, Frederic Weisbecker wrote:
> On Fri, Oct 14, 2022 at 07:21:27AM -0700, Paul E. McKenney wrote:
> > On Tue, Oct 11, 2022 at 06:01:30PM +0000, Joel Fernandes (Google) wrote:
> > > From: Frederic Weisbecker <frederic@...nel.org>
> > > 
> > > Upon entraining a callback to a NOCB CPU, no further wake up is
> > > issued on the corresponding nocb_gp kthread. As a result, the callback
> > > and all the subsequent ones on that CPU may be ignored, at least until
> > > an RCU_NOCB_WAKE_FORCE timer is ever armed or another NOCB CPU belonging
> > > to the same group enqueues a callback on an empty queue.
> > > 
> > > Here is a possible bad scenario:
> > > 
> > > 1) CPU 0 is NOCB unlike all other CPUs.
> > > 2) CPU 0 queues a callback
> > 
> > Call it CB1.
> > 
> > > 2) The grace period related to that callback elapses
> > > 3) The callback is moved to the done list (but is not invoked yet),
> > >    there are no more pending callbacks for CPU 0
> > 
> > So CB1 is on ->cblist waiting to be invoked, correct?
> > 
> > > 4) CPU 1 calls rcu_barrier() and sends an IPI to CPU 0
> > > 5) CPU 0 entrains the callback but doesn't wake up nocb_gp
> > 
> > And CB1 must still be there because otherwise the IPI handler would not
> > have entrained the callback, correct?  If so, we have both CB1 and the
> > rcu_barrier() callback (call it CB2) in ->cblist, but on the done list.
> > 
> > > 6) CPU 1 blocks forever, unless CPU 0 ever queues enough further
> > >    callbacks to arm an RCU_NOCB_WAKE_FORCE timer.
> > 
> > Except that -something- must have already been prepared to wake up in
> > order to invoke CB1.  And that something would invoke CB2 along with CB1,
> > given that they are both on the done list.  If there is no such wakeup
> > already, then the hang could occur with just CB1, without the help of CB2.
> 
> Heh good point. I was confused with CB1 on RCU_DONE_TAIL and the possibility
> for CB2 to be entrained on RCU_WAIT_TAIL. But that's indeed not supposed to
> happen. Ok so this patch indeed doesn't make sense outside lazy.

Whew!!!  ;-)

> > > This is also required to make sure lazy callbacks in future patches
> > > don't end up making rcu_barrier() wait for multiple seconds.
> > 
> > But I do see that the wakeup is needed in the lazy case, and if I remember
> > correctly, the ten-second rcu_barrier() delay really did happen.  If I
> > understand correctly, for this to happen, all of the callbacks must be
> > in the bypass list, that is, ->cblist must be empty.
> > 
> > So has the scenario steps 1-6 called out above actually happened in the
> > absence of lazy callbacks?
> 
> Nope, so I guess we can have the pending check around rcu_nocb_flush_bypass()
> only...

OK, sounds good.

I have put this series on branch lazy.2022.10.14a and am testing it.

							Thanx, Paul