From patchwork Tue Aug 15 13:01:54 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tong Tiangen X-Patchwork-Id: 13353813 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F37CC0015E for ; Tue, 15 Aug 2023 13:04:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AC0E3940019; Tue, 15 Aug 2023 09:04:16 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A710B8D0001; Tue, 15 Aug 2023 09:04:16 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 95FD9940019; Tue, 15 Aug 2023 09:04:16 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 8762E8D0001 for ; Tue, 15 Aug 2023 09:04:16 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 38950120D4C for ; Tue, 15 Aug 2023 13:04:16 +0000 (UTC) X-FDA: 81126357312.16.DBE9828 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by imf05.hostedemail.com (Postfix) with ESMTP id A7CF6100037 for ; Tue, 15 Aug 2023 13:02:06 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=none; spf=pass (imf05.hostedemail.com: domain of tongtiangen@huawei.com designates 45.249.212.188 as permitted sender) smtp.mailfrom=tongtiangen@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1692104527; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=Hd4yX+YDpkz1nDp+sn7qH/84fUoGOUfDYbCSKa+Jxt4=; b=BZMpWi2QVNKDpVma74m41lJEsYArr+sBd6hufMmYSysEFi0fi+axzaubqqMwhbYUDHHyWD rna3UQNYU/cz+7IA6TFkMDexaabXsbzn2YhWUtXqPVW0kb1Wkg5ry0WIqCl4xHxig5JIYa i5HeUK0KI9RCA9vBkvX7Xe8Rs01z+zY= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1692104527; a=rsa-sha256; cv=none; b=CzBv+JVoGOO9SIv9YXHnCpwb2MjjGRiHXk3j7z1ltbNWu+TYjwbwDSL7EdEPB0axiMMka+ DiJNLzvM2SZXDZWLHSe0FtHmhBEl+U7x6u1LJ+blTwnqevFs7P2roJjmDpnZyUrTgf/vlD vpDOj+fZyGK5cVuFJJXqkHxBLNUaJls= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=none; spf=pass (imf05.hostedemail.com: domain of tongtiangen@huawei.com designates 45.249.212.188 as permitted sender) smtp.mailfrom=tongtiangen@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com Received: from kwepemm600017.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4RQBCS1KLCzNmjH; Tue, 15 Aug 2023 20:58:28 +0800 (CST) Received: from localhost.localdomain (10.175.112.125) by kwepemm600017.china.huawei.com (7.193.23.234) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Tue, 15 Aug 2023 21:01:58 +0800 From: Tong Tiangen To: Andrew Morton , Naoya Horiguchi , Miaohe Lin CC: , , Tong Tiangen , , Guohanjun Subject: [RFC PATCH -next] mm: fix softlockup by replacing tasklist_lock with RCU in for_each_process() Date: Tue, 15 Aug 2023 21:01:54 +0800 Message-ID: <20230815130154.1100779-1-tongtiangen@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.112.125] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To kwepemm600017.china.huawei.com (7.193.23.234) X-CFilter-Loop: Reflected X-Rspamd-Queue-Id: A7CF6100037 X-Rspam-User: X-Stat-Signature: zmc65po1isdfibf18y4f74ejerustnqh X-Rspamd-Server: rspam03 X-HE-Tag: 1692104526-653895 X-HE-Meta: U2FsdGVkX1/xXVUj4OQPnD9QMJB9WK07CvzpMdULccITKVniSyFbI3zq3hPm1XSdPYIAuHoFo5ZJH4oScXfF9CJypfok6xBae9vnpweuEbx28l+lU5/EuogqSg+KepZEI2SNRrMSMBOEJmQmhDMRbdiypi/IUUIFxehTkZiPKk0rHU1s9362zrC8avcXIjmFDWbcdXaKu9mrODU3QXnAWQruMF2W7LwoBysYbtgUUWRyEzyZOyj/Lkmjt/8U3YjJCDwT8bl/4rFazvuxDUwmilRuWwQ8wUiejrqA5wmWMuA7whafWefW2VD3ddZikXljHqiYnNnL3v4faHtCR/kIaIx49u1rKsejjLEqGjroAThLw3TwadF/zxAKGQnhyJf5AZOfGmX8xgcWWdfjIQse4G0kDx2x2biIdWx55XCEvx74YYbeVn8UhWnaM6JyIhBsXuwIzDGTKkuS2XPM/odJ5SWlut7zZEe8jSrqzN3PntRX8u2Hdx+JXs16r2HSRRfPJt5S4Sq0+3ujuQqqvxGps7rwPrroVWUESIrU7wmymiJ/dIKyMVaDlzA2JnGLkP5SrVOYlpe2Ip4jn6ubyPlvdZCToFPZYzyEr0nLCeZJ0b52HDkvQzSbT3ZaRW9xBSmGzqgHhHi2lzCTVNLFTau0AKnKhHy5OZNWLg/t7X2YBk66zVFw43VveIn3I4r9Bpa4TwHDJmZhLroDF1Yxw3Wazko+2fKQ3FsP3YoGuzd302M4cXHeIj96hPs/cfkqS6xpy0ui2hCBIXGQMEb3dFDOcwGG4gJZlbBduaROp7egbkbxbyQhBjb68yj4Wo2dRJ0+oQIhz7P3uce7Krln3TAImQ3AOyYHRd7gIOf/SRluPuOUBeasmJmL0SlDwfD04HjPjJoXreynZq5hM/DqjeVebmuMddGg7Nb1sCufgeqyEZFquz4e+EbHe6arqwDhFcT9B/dMLjAECnd8H8vueU9 KTGG6pSz 6BFINWPteqshd/sN5xuvgLc76ZZmzJzLXD85LZ4WpOdS16t9RWbUoYAuVOPS5KbO9eteviO0LoOp244u2defpXeXBpP6lCNfD7c973J2zo82MEL/jj5fvFJjxGXBIhEEm4uWOBDtMY2UawG4j5Iq21sGsUNZyXwKA0Mmm0m5WV1s1qJENt3QYIfhBem/o6lbGJGyP+G1YUFE7LKc= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: We found a softlock issue in our test, analyzed the logs, and found that the relevant CPU call trace as follows: CPU0: _do_fork -> copy_process() -> write_lock_irq(&tasklist_lock) //Disable irq,waiting for //tasklist_lock CPU1: wp_page_copy() ->pte_offset_map_lock() -> spin_lock(&page->ptl); //Hold page->ptl -> ptep_clear_flush() -> flush_tlb_others() ... -> smp_call_function_many() -> arch_send_call_function_ipi_mask() -> csd_lock_wait() //Waiting for other CPUs respond //IPI CPU2: collect_procs_anon() -> read_lock(&tasklist_lock) //Hold tasklist_lock ->for_each_process(tsk) -> page_mapped_in_vma() -> page_vma_mapped_walk() -> map_pte() ->spin_lock(&page->ptl) //Waiting for page->ptl We can see that CPU1 waiting for CPU0 respond IPI，CPU0 waiting for CPU2 unlock tasklist_lock, CPU2 waiting for CPU1 unlock page->ptl. As a result, softlockup is triggered. For collect_procs_anon(), we will not modify the tasklist, but only perform read traversal. Therefore, we can use rcu lock instead of spin lock tasklist_lock, from this, we can break the softlock chain above. The same logic can also be applied to: - collect_procs_file() - collect_procs_fsdax() - collect_procs_ksm() - find_early_kill_thread() Signed-off-by: Tong Tiangen --- mm/ksm.c | 4 ++-- mm/memory-failure.c | 36 ++++++++++++++++++++++-------------- 2 files changed, 24 insertions(+), 16 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index 6b7b8928fb96..dcbc0c7f68e7 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -2919,7 +2919,7 @@ void collect_procs_ksm(struct page *page, struct list_head *to_kill, struct anon_vma *av = rmap_item->anon_vma; anon_vma_lock_read(av); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process(tsk) { struct anon_vma_chain *vmac; unsigned long addr; @@ -2938,7 +2938,7 @@ void collect_procs_ksm(struct page *page, struct list_head *to_kill, } } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); anon_vma_unlock_read(av); } } diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 7b01fffe7a79..6a02706043f4 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -546,24 +546,32 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail, * Find a dedicated thread which is supposed to handle SIGBUS(BUS_MCEERR_AO) * on behalf of the thread group. Return task_struct of the (first found) * dedicated thread if found, and return NULL otherwise. - * - * We already hold read_lock(&tasklist_lock) in the caller, so we don't - * have to call rcu_read_lock/unlock() in this function. */ static struct task_struct *find_early_kill_thread(struct task_struct *tsk) { struct task_struct *t; + bool find = false; + rcu_read_lock(); for_each_thread(tsk, t) { if (t->flags & PF_MCE_PROCESS) { - if (t->flags & PF_MCE_EARLY) - return t; + if (t->flags & PF_MCE_EARLY) { + find = true; + break; + } } else { - if (sysctl_memory_failure_early_kill) - return t; + if (sysctl_memory_failure_early_kill) { + find = true; + break; + } } } - return NULL; + rcu_read_unlock(); + + if (!find) + t = NULL; + + return t; } /* @@ -609,7 +617,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, return; pgoff = page_to_pgoff(page); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process(tsk) { struct anon_vma_chain *vmac; struct task_struct *t = task_early_kill(tsk, force_early); @@ -626,7 +634,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, add_to_kill_anon_file(t, page, vma, to_kill); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); anon_vma_unlock_read(av); } @@ -642,7 +650,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, pgoff_t pgoff; i_mmap_lock_read(mapping); - read_lock(&tasklist_lock); + rcu_read_lock(); pgoff = page_to_pgoff(page); for_each_process(tsk) { struct task_struct *t = task_early_kill(tsk, force_early); @@ -662,7 +670,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, add_to_kill_anon_file(t, page, vma, to_kill); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); i_mmap_unlock_read(mapping); } @@ -685,7 +693,7 @@ static void collect_procs_fsdax(struct page *page, struct task_struct *tsk; i_mmap_lock_read(mapping); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process(tsk) { struct task_struct *t = task_early_kill(tsk, true); @@ -696,7 +704,7 @@ static void collect_procs_fsdax(struct page *page, add_to_kill_fsdax(t, page, vma, to_kill, pgoff); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); i_mmap_unlock_read(mapping); } #endif /* CONFIG_FS_DAX */