[PATCH] posix-cpu-timers: Clear posix_cputimers_work in copy_process

[Michael Pratt <mpratt@google.com>]

copy_process currently copies task_struct.posix_cputimers_work as-is. If a
timer interrupt arrives while handling clone and before dup_task_struct
completes then the child task will have:

1. posix_cputimers_work.scheduled = true
2. posix_cputimers_work.work queued.

copy_process clears task_struct.task_works, so (2) will have no effect and
posix_cpu_timers_work will never run (not to mention it doesn't make sense
for two tasks to share a common linked list).

Since posix_cpu_timers_work never runs, posix_cputimers_work.scheduled is
never cleared. Since scheduled is set, future timer interrupts will skip
scheduling work, with the ultimate result that the task will never receive
timer expirations.

Together, the complete flow is:

1. Task 1 calls clone(), enters kernel.
2. Timer interrupt fires, schedules task work on Task 1.
   2a. task_struct.posix_cputimers_work.scheduled = true
   2b. task_struct.posix_cputimers_work.work added to
       task_struct.task_works.
3. dup_task_struct copies Task 1 to Task 2.
4. copy_process clears task_struct.task_works for Task 2.
5. Future timer interrupts on Task 2 see
   task_struct.posix_cputimers_work.scheduled = true and skip scheduling
   work.

Fix this by explicitly clearing contents of
task_struct.posix_cputimers_work in copy_process. This was never meant to
be shared or inherited across tasks in the first place.

Signed-off-by: Michael Pratt <mpratt@google.com>
Reported-by: Rhys Hiltner <rhys@justin.tv>
Fixes: 1fb497dd0030 ("posix-cpu-timers: Provide mechanisms to defer timer handling to task_work")
Cc: <stable@vger.kernel.org>
---
This issue was discovered while investigating a flaky test in the Go
language standard libary, https://golang.org/issue/49065. After our testing
VMs upgraded from 5.4 to 5.10 kernels, several profiling tests started
failing ~1% of the time with threads not receiving their expected profiling
signals.

Bisection of problem by Rhys blamed b6b178e38f40 ("Merge tag
'timers-core-2020-08-14' of
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip"). This merge commit
introduced the broken commit 1fb497dd0030 ("posix-cpu-timers: Provide
mechanisms to defer timer handling to task_work") and its child
0099808553ad ("x86: Select POSIX_CPU_TIMERS_TASK_WORK"), which enables the
new codepath.

The C program below also reproduces the problem. Build with `gcc repro.c
-lrt -pthread -O2`.

The program starts a CPU timer on the main thread, which then spawns child
threads that create their own CPU timers and verify that they receive timer
signals. At HEAD and 0099808553ad this program fails with ~3-15 / 20000
threads not receiving signals.

Prior to 0099808553ad and with this patch, the program reports no failures.

// SPDX-License-Identifier: GPL-2.0
#include <pthread.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

__thread uint64_t signaled;

_Atomic int threads_bad;

void signal_handler(int signo, siginfo_t *siginfo, void *uctx)
{
	signaled++;
}

int gettid(void)
{
	return syscall(SYS_gettid);
}

timer_t setup_timer(void)
{
	struct sigevent sev = {
		.sigev_signo = SIGPROF,
		.sigev_notify = SIGEV_THREAD_ID,
		._sigev_un = {
			._tid = gettid(),
		},
	};
	struct itimerspec spec = {
		.it_interval = {
			.tv_nsec = 10*1000*1000, /* 10ms */
		},
		.it_value = {
			.tv_nsec = 10*1000*1000, /* 10ms */
		},
	};
	timer_t timerid;
	int ret;

	ret = timer_create(CLOCK_THREAD_CPUTIME_ID, &sev, &timerid);
	if (ret != 0) {
		perror("timer_create");
		_exit(1);
	}

	ret = timer_settime(timerid, 0, &spec, NULL);
	if (ret != 0) {
		perror("timer_settime");
		_exit(1);
	}

	return timerid;
}

uint64_t thread_cpu_ns(void)
{
	struct timespec ts;
	int ret;

	ret = clock_gettime(CLOCK_THREAD_CPUTIME_ID, &ts);
	if (ret != 0) {
		perror("clock_gettime");
		_exit(1);
	}
	return ts.tv_nsec + 1000*1000*1000*ts.tv_sec;
}

void *thread(void *arg)
{
	timer_t timerid;
	uint64_t start;
	int ret;

	timerid = setup_timer();

	start = thread_cpu_ns();
	while (1) {
		uint64_t now;

		/* 50ms passed? */
		now = thread_cpu_ns();
		if (now - start > 50*1000*1000)
			break;

		/* Busy loop */
		for (volatile int i = 0; i < 100000; i++)
			;
	}

	/*
	 * 50ms passed; we should certainly have received some profiling
	 * signals.
	 */
	if (signaled == 0) {
		printf("Thread %d received no profiling signals!\n", gettid());
		threads_bad++;
	}

	ret = timer_delete(timerid);
	if (ret != 0) {
		perror("timer_delete");
		_exit(1);
	}

	return NULL;
}

int main(void)
{
	struct sigaction sa = {
		.sa_sigaction = &signal_handler,
		.sa_flags = SA_SIGINFO | SA_RESTART,
	};
	int ret;
	sigset_t set;
	timer_t timerid;
	int bad;
	int thread_count = 0;

	ret = sigaction(SIGPROF, &sa, NULL);
	if (ret != 0) {
		perror("sigaction");
		return 1;
	}

	sigemptyset(&set);
	sigaddset(&set, SIGPROF);
	ret = sigprocmask(SIG_UNBLOCK, &set, NULL);
	if (ret != 0) {
		perror("sigprocmask");
		return 1;
	}

	timerid = setup_timer();

	while (thread_count < 20000) {
		pthread_t threads[10];

		for (int i = 0; i < 10; i++) {
			ret = pthread_create(&threads[i], NULL, &thread, NULL);
			if (ret != 0) {
				perror("pthread_create");
				return 1;
			}
			thread_count++;
		}

		/* Busy loop */
		for (volatile int i = 0; i < 100000; i++)
			;

		for (int i = 0; i < 10; i++) {
			ret = pthread_join(threads[i], NULL);
			if (ret != 0) {
				perror("pthread_join");
				return 1;
			}
		}

		if (thread_count % 100 == 0)
			printf("%d threads\n", thread_count);
	}

	bad = threads_bad;
	printf("Bad threads %d / %d = %f%%\n", threads_bad, thread_count,
	       100*((double)threads_bad) / ((double)thread_count));

	if (threads_bad > 0)
		return 1;
	return 0;
}

 include/linux/posix-timers.h   |  2 ++
 kernel/fork.c                  |  1 +
 kernel/time/posix-cpu-timers.c | 19 +++++++++++++++++--
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
index 00fef0064355..5bbcd280bfd2 100644
--- a/include/linux/posix-timers.h
+++ b/include/linux/posix-timers.h
@@ -184,8 +184,10 @@ static inline void posix_cputimers_group_init(struct posix_cputimers *pct,
 #endif
 
 #ifdef CONFIG_POSIX_CPU_TIMERS_TASK_WORK
+void clear_posix_cputimers_work(struct task_struct *p);
 void posix_cputimers_init_work(void);
 #else
+static inline void clear_posix_cputimers_work(struct task_struct *p) { }
 static inline void posix_cputimers_init_work(void) { }
 #endif
 
diff --git a/kernel/fork.c b/kernel/fork.c
index 38681ad44c76..b1551c074b74 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2280,6 +2280,7 @@ static __latent_entropy struct task_struct *copy_process(
 	p->pdeath_signal = 0;
 	INIT_LIST_HEAD(&p->thread_group);
 	p->task_works = NULL;
+	clear_posix_cputimers_work(p);
 
 #ifdef CONFIG_KRETPROBES
 	p->kretprobe_instances.first = NULL;
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 643d412ac623..96b4e7810426 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1158,14 +1158,29 @@ static void posix_cpu_timers_work(struct callback_head *work)
 	handle_posix_cpu_timers(current);
 }
 
+/*
+ * Clear existing posix CPU timers task work.
+ */
+void clear_posix_cputimers_work(struct task_struct *p)
+{
+	/*
+	 * A copied work entry from the old task is not meaningful, clear it.
+	 * N.B. init_task_work will not do this.
+	 */
+	memset(&p->posix_cputimers_work.work, 0,
+	       sizeof(p->posix_cputimers_work.work));
+	init_task_work(&p->posix_cputimers_work.work,
+		       posix_cpu_timers_work);
+	p->posix_cputimers_work.scheduled = false;
+}
+
 /*
  * Initialize posix CPU timers task work in init task. Out of line to
  * keep the callback static and to avoid header recursion hell.
  */
 void __init posix_cputimers_init_work(void)
 {
-	init_task_work(&current->posix_cputimers_work.work,
-		       posix_cpu_timers_work);
+	clear_posix_cputimers_work(current);
 }
 
 /*
-- 
2.33.1.1089.g2158813163f-goog