linux-kernel - Re: [BUG] RCU Detected Stall in sys_process_vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c97d341a-a06c-420e-8bdf-5bcfcb08a03d@intel.com>
Date: Mon, 19 May 2025 08:42:38 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: David Hildenbrand <david@...hat.com>, Guoyu Yin <y04609127@...il.com>,
 akpm@...ux-foundation.org
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org,
 dave.hansen@...ux.intel.com, luto@...nel.org, peterz@...radead.org,
 tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, x86@...nel.org,
 hpa@...or.com
Subject: Re: [BUG] RCU Detected Stall in sys_process_vm_writev

On 5/19/25 00:36, David Hildenbrand wrote:
>>  From the dmesg log, CPU 3 is stuck trying to acquire a spinlock in the
>> pgd_free function (arch/x86/mm/pgtable.c:490), leading to the RCU
>> stall. This is likely caused by spinlock contention triggered by the
>> page pinning and unpinning logic in sys_process_vm_writev under high
>> load or abnormal conditions.
> 
> pgd_free() calls pgd_dtor() where we should be taking the pgd_lock.
> Apart from that, only the buddy allocator might be taking locks when
> freeing the page.

Yeah, it's definitely the pgd_lock.

I just did a quick audit of all the sites that use it and I didn't see
any places where we could have left it locked. The most likely means
it's _another_ lock underneath (like pgt_lock) that's stuck. The other
possibility is that the thread holding pgd_lock got in trouble like with
a BUG_ON().

Guoyu Yin: Can you try to reproduce this with lockdep enabled, please?

It would also be useful to see the state of all the other threads in the
system. Are any of them stuck in a path that holds pgd_lock?

> As I am sure you wouldn't bother us with AI generated slop, what
> makes you think that the pgd_lock is relevant in the context of
> GUP?

Yeah, I think someone (or some bad AI bot) is looking at the use of
'pgd_lock' in xen_mm_pin/unpin_all() and somehow connecting that to
pin_user_pages().