From: Thomas Gleixner <tglx@linutronix.de>
To: Ye Bin <yebin@huaweicloud.com>,
dennis@kernel.org, tj@kernel.org, cl@linux.com,
linux-mm@kvack.org, yury.norov@gmail.com,
andriy.shevchenko@linux.intel.com, linux@rasmusvillemoes.dk
Cc: linux-kernel@vger.kernel.org, dchinner@redhat.com,
yebin10@huawei.com, yebin@huaweicloud.com,
Peter Zijlstra <peterz@infradead.org>,
Valentin Schneider <vschneid@redhat.com>,
Linus Torvalds <torvalds@linuxfoundation.org>
Subject: Re: [PATCH v2 2/2] lib/percpu_counter: fix dying cpu compare race
Date: Mon, 10 Apr 2023 22:53:30 +0200 [thread overview]
Message-ID: <877cuj1mt1.ffs@tglx> (raw)
In-Reply-To: <20230406015629.1804722-3-yebin@huaweicloud.com>
On Thu, Apr 06 2023 at 09:56, Ye Bin wrote:
> From: Ye Bin <yebin10@huawei.com>
>
> In commit 8b57b11cca88 ("pcpcntrs: fix dying cpu summation race") a race
> condition between a cpu dying and percpu_counter_sum() iterating online CPUs
> was identified.
> Acctually, there's the same race condition between a cpu dying and
> __percpu_counter_compare(). Here, use 'num_online_cpus()' for quick judgment.
> But 'num_online_cpus()' will be decreased before call 'percpu_counter_cpu_dead()',
> then maybe return incorrect result.
> To solve above issue, also need to add dying CPUs count when do quick judgment
> in __percpu_counter_compare().
This is all bogus including the above commit.
All CPU masks including cpu_online_mask and cpu_dying_mask are only
valid when the context is:
- A CPU hotplug callback
- Any other code which holds cpu_hotplug_lock read or write locked.
cpu_online_mask is special in that regard. It is also protected against
modification in any preemption disabled region, but that's a pure
implementation detail.
cpu_dying_mask is a random number generator w/o cpu_hotplug_lock being
held. And even with that lock held any cpumask operation on it is silly.
The mask is a core detail:
commit e40f74c535b8 "cpumask: Introduce DYING mask"
Introduce a cpumask that indicates (for each CPU) what direction the
CPU hotplug is currently going. Notably, it tracks rollbacks. Eg. when
an up fails and we do a roll-back down, it will accurately reflect the
direction.
It does not tell anything to a user which is not aware of the actual
hotplug state machine state.
The real reason for this percpu counter issue is how percpu counter
hotplug callbacks are implemented: They are asymmetric and at the
completely wrong place.
The above 8b57b11cca88 ("pcpcntrs: fix dying cpu summation race") was
done via XFS and without the courtesy of CC'ing the people who care
about the CPU hotplug core. The lenghty analysis of this commit is all
shiny, but fundamentally wrong. See above.
I'm way too tired to come up with a proper fix for this mess, but I'm
going to stare at it tomorrow morning with brain awake.
Thanks,
tglx
next prev parent reply other threads:[~2023-04-10 20:53 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-06 1:56 [PATCH v2 0/2] fix dying cpu compare race Ye Bin
2023-04-06 1:56 ` [PATCH v2 1/2] cpu/hotplug: introduce 'num_dying_cpus' to get dying CPUs count Ye Bin
2023-04-10 17:42 ` Yury Norov
2023-04-10 20:12 ` Thomas Gleixner
2023-04-06 1:56 ` [PATCH v2 2/2] lib/percpu_counter: fix dying cpu compare race Ye Bin
2023-04-08 7:13 ` Dennis Zhou
2023-04-10 20:53 ` Thomas Gleixner [this message]
2023-04-11 6:56 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877cuj1mt1.ffs@tglx \
--to=tglx@linutronix.de \
--cc=andriy.shevchenko@linux.intel.com \
--cc=cl@linux.com \
--cc=dchinner@redhat.com \
--cc=dennis@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux@rasmusvillemoes.dk \
--cc=peterz@infradead.org \
--cc=tj@kernel.org \
--cc=torvalds@linuxfoundation.org \
--cc=vschneid@redhat.com \
--cc=yebin10@huawei.com \
--cc=yebin@huaweicloud.com \
--cc=yury.norov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).