From: Hillf Danton <hdanton@sina.com> To: Uladzislau Rezki <urezki@gmail.com> Cc: syzbot <syzbot+1fa663a2100308ab6eab@syzkaller.appspotmail.com>, Alexei Starovoitov <alexei.starovoitov@gmail.com>, "Paul E. McKenney" <paulmck@kernel.org>, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bpf?] possible deadlock in kvfree_call_rcu Date: Sun, 31 Mar 2024 14:23:14 +0800 [thread overview] Message-ID: <20240331062314.3394-1-hdanton@sina.com> (raw) In-Reply-To: <ZghSHWexmBHXpyA-@pc638.lan> On Sat, 30 Mar 2024 18:55:41 +0100 Uladzislau Rezki <urezki@gmail.com> > diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c > index d9642dd06c25..8867aac3668c 100644 > --- a/kernel/rcu/tree.c > +++ b/kernel/rcu/tree.c > @@ -3467,19 +3467,19 @@ void kvfree_call_rcu(struct rcu_head *head, void *ptr) > */ > kmemleak_ignore(ptr); > > - // Set timer to drain after KFREE_DRAIN_JIFFIES. > - if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING) > - schedule_delayed_monitor_work(krcp); > - This is not enough at least WRT run_page_cache_worker() [1] [1] https://lore.kernel.org/lkml/0000000000007a44120614e27cb7@google.com/ while the reason why syzbot failed to catch the zone->per_cpu_pageset in setup_zone_pageset() in mm/page_alloc.c is trylock [2] [2] https://lore.kernel.org/lkml/000000000000a5ee4e0614ee586e@google.com/ > unlock_return: > krc_this_cpu_unlock(krcp, flags); > > - /* > - * Inline kvfree() after synchronize_rcu(). We can do > - * it from might_sleep() context only, so the current > - * CPU can pass the QS state. > - */ > - if (!success) { > + if (success) { > + // Set timer to drain after KFREE_DRAIN_JIFFIES. > + if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING) > + schedule_delayed_monitor_work(krcp); > + } else { > + /* > + * Inline kvfree() after synchronize_rcu(). We can do > + * it from might_sleep() context only, so the current > + * CPU can pass the QS state. > + */ > debug_rcu_head_unqueue((struct rcu_head *) ptr); > synchronize_rcu(); > kvfree(ptr); > > > --
WARNING: multiple messages have this Message-ID (diff)
From: Hillf Danton <hdanton@sina.com> To: Uladzislau Rezki <urezki@gmail.com> Cc: syzbot <syzbot+1fa663a2100308ab6eab@syzkaller.appspotmail.com>, "Alexei Starovoitov" <alexei.starovoitov@gmail.com>, "Paul E. McKenney" <paulmck@kernel.org>, <linux-kernel@vger.kernel.org>, <syzkaller-bugs@googlegroups.com> Subject: Re: [syzbot] [bpf?] possible deadlock in kvfree_call_rcu Date: Sun, 31 Mar 2024 14:23:14 +0800 [thread overview] Message-ID: <20240331062314.3394-1-hdanton@sina.com> (raw) Message-ID: <20240331062314.sCbqrS3oKoR7rt1dGGV8_Cop1fvgU3GKDq_TlmV-khQ@z> (raw) In-Reply-To: <ZghSHWexmBHXpyA-@pc638.lan> On Sat, 30 Mar 2024 18:55:41 +0100 Uladzislau Rezki <urezki@gmail.com> > diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c > index d9642dd06c25..8867aac3668c 100644 > --- a/kernel/rcu/tree.c > +++ b/kernel/rcu/tree.c > @@ -3467,19 +3467,19 @@ void kvfree_call_rcu(struct rcu_head *head, void *ptr) > */ > kmemleak_ignore(ptr); > > - // Set timer to drain after KFREE_DRAIN_JIFFIES. > - if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING) > - schedule_delayed_monitor_work(krcp); > - This is not enough at least WRT run_page_cache_worker() [1] [1] https://lore.kernel.org/lkml/0000000000007a44120614e27cb7@google.com/ while the reason why syzbot failed to catch the zone->per_cpu_pageset in setup_zone_pageset() in mm/page_alloc.c is trylock [2] [2] https://lore.kernel.org/lkml/000000000000a5ee4e0614ee586e@google.com/ > unlock_return: > krc_this_cpu_unlock(krcp, flags); > > - /* > - * Inline kvfree() after synchronize_rcu(). We can do > - * it from might_sleep() context only, so the current > - * CPU can pass the QS state. > - */ > - if (!success) { > + if (success) { > + // Set timer to drain after KFREE_DRAIN_JIFFIES. > + if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING) > + schedule_delayed_monitor_work(krcp); > + } else { > + /* > + * Inline kvfree() after synchronize_rcu(). We can do > + * it from might_sleep() context only, so the current > + * CPU can pass the QS state. > + */ > debug_rcu_head_unqueue((struct rcu_head *) ptr); > synchronize_rcu(); > kvfree(ptr); > > > --
next prev parent reply other threads:[~2024-03-31 6:26 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-03-26 19:00 [syzbot] [bpf?] possible deadlock in kvfree_call_rcu syzbot 2024-03-26 19:53 ` false positive deadlock? Was: " Alexei Starovoitov 2024-03-27 4:37 ` Paul E. McKenney 2024-03-27 5:04 ` Paul E. McKenney 2024-03-28 0:12 ` Alexei Starovoitov 2024-03-27 23:27 ` syzbot 2024-03-28 23:07 ` Hillf Danton 2024-03-29 16:17 ` syzbot 2024-03-30 0:27 ` Hillf Danton 2024-03-30 15:34 ` syzbot 2024-03-30 23:42 ` Hillf Danton 2024-03-30 23:42 ` Hillf Danton 2024-03-31 5:43 ` syzbot 2024-03-31 6:19 ` Hillf Danton 2024-03-31 7:03 ` syzbot 2024-03-31 7:03 ` syzbot 2024-03-30 17:55 ` Uladzislau Rezki 2024-03-31 6:23 ` Hillf Danton [this message] 2024-03-31 6:23 ` Hillf Danton 2024-03-31 7:25 ` Uladzislau Rezki 2024-03-31 6:28 ` Uladzislau Rezki 2024-03-31 6:54 ` syzbot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240331062314.3394-1-hdanton@sina.com \ --to=hdanton@sina.com \ --cc=alexei.starovoitov@gmail.com \ --cc=linux-kernel@vger.kernel.org \ --cc=paulmck@kernel.org \ --cc=syzbot+1fa663a2100308ab6eab@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=urezki@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.