| Message ID | 1424873603-16386-1-git-send-email-mst@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Wed, 25 Feb 2015 15:14:36 +0100 "Michael S. Tsirkin" <mst@redhat.com> wrote: > virtio balloon has this code: > wait_event_interruptible(vb->config_change, > (diff = towards_target(vb)) != 0 > || vb->need_stats_update > || kthread_should_stop() > || freezing(current)); > > Which is a problem because towards_target() call might block after > wait_event_interruptible sets task state to TAST_INTERRUPTIBLE, causing > the task_struct::state collision typical of nesting of sleeping > primitives > > See also http://lwn.net/Articles/628628/ or Thomas's > bug report > http://article.gmane.org/gmane.linux.kernel.virtualization/24846 > for a fuller explanation. > > To fix, rewrite using wait_woken. > > Cc: stable@vger.kernel.org > Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com> > Signed-off-by: Michael S. Tsirkin <mst@redhat.com> > --- > drivers/virtio/virtio_balloon.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > > diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c > index 0413157..2f19f65 100644 > --- a/drivers/virtio/virtio_balloon.c > +++ b/drivers/virtio/virtio_balloon.c > @@ -29,6 +29,7 @@ > #include <linux/module.h> > #include <linux/balloon_compaction.h> > #include <linux/oom.h> > +#include <linux/wait.h> > > /* > * Balloon device works in 4K page units. So each page is pointed to by > @@ -334,12 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self, > static int balloon(void *_vballoon) > { > struct virtio_balloon *vb = _vballoon; > + DEFINE_WAIT_FUNC(wait, woken_wake_function); > > set_freezable(); > while (!kthread_should_stop()) { > s64 diff; > > try_to_freeze(); > + > + add_wait_queue(&vb->config_change, &wait); > + for (;;) { > + if ((diff = towards_target(vb)) != 0 || > + vb->need_stats_update || > + kthread_should_stop() || > + freezing(current)) > + break; > + wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); > + } > + remove_wait_queue(&vb->config_change, &wait); > + > wait_event_interruptible(vb->config_change, > (diff = towards_target(vb)) != 0 > || vb->need_stats_update Forgot to remove the wait_event_interruptible()? -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Feb 25, 2015 at 03:32:08PM +0100, Cornelia Huck wrote: > On Wed, 25 Feb 2015 15:14:36 +0100 > "Michael S. Tsirkin" <mst@redhat.com> wrote: > > > virtio balloon has this code: > > wait_event_interruptible(vb->config_change, > > (diff = towards_target(vb)) != 0 > > || vb->need_stats_update > > || kthread_should_stop() > > || freezing(current)); > > > > Which is a problem because towards_target() call might block after > > wait_event_interruptible sets task state to TAST_INTERRUPTIBLE, causing > > the task_struct::state collision typical of nesting of sleeping > > primitives > > > > See also http://lwn.net/Articles/628628/ or Thomas's > > bug report > > http://article.gmane.org/gmane.linux.kernel.virtualization/24846 > > for a fuller explanation. > > > > To fix, rewrite using wait_woken. > > > > Cc: stable@vger.kernel.org > > Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com> > > Signed-off-by: Michael S. Tsirkin <mst@redhat.com> > > --- > > drivers/virtio/virtio_balloon.c | 14 ++++++++++++++ > > 1 file changed, 14 insertions(+) > > > > diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c > > index 0413157..2f19f65 100644 > > --- a/drivers/virtio/virtio_balloon.c > > +++ b/drivers/virtio/virtio_balloon.c > > @@ -29,6 +29,7 @@ > > #include <linux/module.h> > > #include <linux/balloon_compaction.h> > > #include <linux/oom.h> > > +#include <linux/wait.h> > > > > /* > > * Balloon device works in 4K page units. So each page is pointed to by > > @@ -334,12 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self, > > static int balloon(void *_vballoon) > > { > > struct virtio_balloon *vb = _vballoon; > > + DEFINE_WAIT_FUNC(wait, woken_wake_function); > > > > set_freezable(); > > while (!kthread_should_stop()) { > > s64 diff; > > > > try_to_freeze(); > > + > > + add_wait_queue(&vb->config_change, &wait); > > + for (;;) { > > + if ((diff = towards_target(vb)) != 0 || > > + vb->need_stats_update || > > + kthread_should_stop() || > > + freezing(current)) > > + break; > > + wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); > > + } > > + remove_wait_queue(&vb->config_change, &wait); > > + > > wait_event_interruptible(vb->config_change, > > (diff = towards_target(vb)) != 0 > > || vb->need_stats_update > > Forgot to remove the wait_event_interruptible()? Ugh. Forgot to commit :( Will resend. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c index 0413157..2f19f65 100644 --- a/drivers/virtio/virtio_balloon.c +++ b/drivers/virtio/virtio_balloon.c @@ -29,6 +29,7 @@ #include <linux/module.h> #include <linux/balloon_compaction.h> #include <linux/oom.h> +#include <linux/wait.h> /* * Balloon device works in 4K page units. So each page is pointed to by @@ -334,12 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self, static int balloon(void *_vballoon) { struct virtio_balloon *vb = _vballoon; + DEFINE_WAIT_FUNC(wait, woken_wake_function); set_freezable(); while (!kthread_should_stop()) { s64 diff; try_to_freeze(); + + add_wait_queue(&vb->config_change, &wait); + for (;;) { + if ((diff = towards_target(vb)) != 0 || + vb->need_stats_update || + kthread_should_stop() || + freezing(current)) + break; + wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); + } + remove_wait_queue(&vb->config_change, &wait); + wait_event_interruptible(vb->config_change, (diff = towards_target(vb)) != 0 || vb->need_stats_update
virtio balloon has this code: wait_event_interruptible(vb->config_change, (diff = towards_target(vb)) != 0 || vb->need_stats_update || kthread_should_stop() || freezing(current)); Which is a problem because towards_target() call might block after wait_event_interruptible sets task state to TAST_INTERRUPTIBLE, causing the task_struct::state collision typical of nesting of sleeping primitives See also http://lwn.net/Articles/628628/ or Thomas's bug report http://article.gmane.org/gmane.linux.kernel.virtualization/24846 for a fuller explanation. To fix, rewrite using wait_woken. Cc: stable@vger.kernel.org Reported-by: Thomas Huth <thuth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> --- drivers/virtio/virtio_balloon.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)