From patchwork Mon Aug 21 02:25:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tong Tiangen X-Patchwork-Id: 13358958 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2186EE49A4 for ; Mon, 21 Aug 2023 02:25:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 540718D0005; Sun, 20 Aug 2023 22:25:45 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4F08F8D0001; Sun, 20 Aug 2023 22:25:45 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3B8458D0005; Sun, 20 Aug 2023 22:25:45 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 2CDB48D0001 for ; Sun, 20 Aug 2023 22:25:45 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id EC5C91201DC for ; Mon, 21 Aug 2023 02:25:44 +0000 (UTC) X-FDA: 81146521008.03.761AF5B Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by imf06.hostedemail.com (Postfix) with ESMTP id 4E25118001A for ; Mon, 21 Aug 2023 02:25:40 +0000 (UTC) Authentication-Results: imf06.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf06.hostedemail.com: domain of tongtiangen@huawei.com designates 45.249.212.188 as permitted sender) smtp.mailfrom=tongtiangen@huawei.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1692584743; a=rsa-sha256; cv=none; b=dyPon9cGIfIZ5TdaJbZl4YOxoeqwDW9bvxMs00mgTkOVQEMyPJ/qgfhXuLCf3f9iqGmQ19 GKttUaSUzg50NXJ6C/a/1bVtVIEGb43Rhe/LJlytUdjJ3UNQm9iZdWLMxl6mVvz7K2QDUK Io+Sb7sIWXzCEVk0ZLV7d9ehQmB6DFg= ARC-Authentication-Results: i=1; imf06.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf06.hostedemail.com: domain of tongtiangen@huawei.com designates 45.249.212.188 as permitted sender) smtp.mailfrom=tongtiangen@huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1692584743; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=MhWko3DBmcNukPf9gwEkN4OC9Y35l9ed/EnlHVjI22Q=; b=oF3y5zUsecrSdm9zl4P0KjZv+qyUCAQvuMY2ufsT/4IJFSb/P5vmGFR/en79BGUfzgpPAH DpTaRLtPYEqN7Ai6zO9yif+GLn+dBpV/nPxr031YwlJacAToMTTbH5DH3rZW5IF7DQ8wth vftPTC9EcJkQlylsM7j6e0pGZoekUd8= Received: from kwepemm600017.china.huawei.com (unknown [172.30.72.57]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4RTbqw4nB5zVjNj; Mon, 21 Aug 2023 10:23:24 +0800 (CST) Received: from localhost.localdomain (10.175.112.125) by kwepemm600017.china.huawei.com (7.193.23.234) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Mon, 21 Aug 2023 10:25:36 +0800 From: Tong Tiangen To: Andrew Morton , Naoya Horiguchi , Miaohe Lin , CC: , Subject: [PATCH] mm: memory-failure: use rcu lock instead of tasklist_lock when collect_procs() Date: Mon, 21 Aug 2023 10:25:34 +0800 Message-ID: <20230821022534.1381092-1-tongtiangen@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.112.125] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To kwepemm600017.china.huawei.com (7.193.23.234) X-CFilter-Loop: Reflected X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 4E25118001A X-Stat-Signature: scnmueo6qbzdogo1pxtsdufddagufwq3 X-Rspam-User: X-HE-Tag: 1692584740-164484 X-HE-Meta: U2FsdGVkX1+GY07Gx51kxatyDJ50ULcUqCQVHT+0qE7i5A113DVAH30LAZ6zRNNOVWMuvs683XU2tQSM6eeAF1czABb3k8pV2Xm1MGZEHzxBrybthriLL00RiRvV7YLc6Ny1ggXa3Hx1JoPFFPHp+o7pFhU9sBt8W6A9/gmFRWG3US+OJ0Yisso4EB/g8YBJrSSLLFXa2iDZhJAbydgoZmRjOxAOtxKN0E+gd/760Ap+sdPo9DP2/Nu13CuoNzO5TxmEq9U0sm3r4TWNWoTAqeFjpGYcJWm/2ONLIlWN6SZ+uccxoZbm96zLlW30s0zyI503rrzIki1Y61h4TO3f0BHDrR/3b/L/pOtWff8+iodm8LiQngPGagwhMGu9r1zO6CQp0+1okq1U1yADKxrgdypw0fUf+AXk7ouLzT5eEm29/uSPQNYPAphSoQ2r1URNaJIOnlNbyyb+o2kB1CvJ9QaKeAEyJ9AalqqnlV+gmHSiQ5kJp4bo+AT1g5iWFvNkZwC7JD0CKHGCh1OMfm+fFHKdYsO3ZpkwbV/B53u6SFnJgF+1FjtjagLz9yLJfKYueQJXljTQo7Gqwh/1ku1obWz+X0atojlEmhwjMyjYOtwQu2+8AhWl6oay3TUAZ+MNeO/oa/Zy/elcjszf4Ez1aJzsYihvnjtGJjJxQ770f55Wj9/qtxwOqICRAIa8ypSjg+aucILUjE50AJDG2R60lc1mcfzcuGk1S9PgcF3l0mi/x+lnOqo7kEWDIfe19amCuvc3B5LQYpdjL8Iqq70fwTnyHmCEWgXDXvTvfcxsLFs7j1w4z2NOndIFI6s7xNxbaatYTsp5JkC81zBdARNm1dNR9DW4L1qHj3PJqxr5SadLO/o27CwnbdAMiFAnVxGlw0z+MUDcpaR5jo6+wSJxSvSUJLs1mr2IvXF1mGEMxFNvOaiGQnaKS6l0u2Tb322HYFBLfIHHDBmmBW+nWnK 1Lq7KnsE beJwkiR2U2Ho7YkvhdM7GZvxbF0ygIOzIDjyDY6szMP/ksLrGN/Q4GYeb1VFrKTXcRA78ZjyhYhYsjU7Xqe+HZCght24SibW7zkWLuVA4bXWbL7SLAgFik9Sj2cdVLPdKGpVjoI8Vj/C9L4t+JX45JdwN2nXU3T7Uq9gcFP8AsOXYSPkWwKFVOS7TUiKsSv98AJZr0cfNIwMGBTxxfseS59I9R8wa/GGxFEv9Mw7UEw6HFa/sWQjxbG47MVIl8lb3XTWLU1hPZPxFPT8= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: We found a softlock issue in our test, analyzed the logs, and found that the relevant CPU call trace as follows: CPU0: _do_fork -> copy_process() -> write_lock_irq(&tasklist_lock) //Disable irq,waiting for //tasklist_lock CPU1: wp_page_copy() ->pte_offset_map_lock() -> spin_lock(&page->ptl); //Hold page->ptl -> ptep_clear_flush() -> flush_tlb_others() ... -> smp_call_function_many() -> arch_send_call_function_ipi_mask() -> csd_lock_wait() //Waiting for other CPUs respond //IPI CPU2: collect_procs_anon() -> read_lock(&tasklist_lock) //Hold tasklist_lock ->for_each_process(tsk) -> page_mapped_in_vma() -> page_vma_mapped_walk() -> map_pte() ->spin_lock(&page->ptl) //Waiting for page->ptl We can see that CPU1 waiting for CPU0 respond IPI，CPU0 waiting for CPU2 unlock tasklist_lock, CPU2 waiting for CPU1 unlock page->ptl. As a result, softlockup is triggered. For collect_procs_anon(), we will not modify the tasklist, but only perform read traversal. Therefore, we can use rcu lock instead of spin lock tasklist_lock, from this, we can break the softlock chain above. The same logic can also be applied to: - collect_procs_file() - collect_procs_fsdax() - collect_procs_ksm() - find_early_kill_thread() Signed-off-by: Tong Tiangen Acked-by: Naoya Horiguchi --- Changes since RFC[1]: - 1. According to Naoya's suggestion, modify the tasklist_lock in the comment about locking order in mm/filemap.c. - 2. According to Kefeng's suggestion, optimize the implementation of find_early_kill_thread() without functional changes. - 3. Modify the title description. [1] https://lore.kernel.org/lkml/20230815130154.1100779-1-tongtiangen@huawei.com/ --- mm/filemap.c | 3 --- mm/ksm.c | 4 ++-- mm/memory-failure.c | 26 ++++++++++++++------------ 3 files changed, 16 insertions(+), 17 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index 014b73eb96a1..dfade1ef1765 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -121,9 +121,6 @@ * bdi.wb->list_lock (zap_pte_range->set_page_dirty) * ->inode->i_lock (zap_pte_range->set_page_dirty) * ->private_lock (zap_pte_range->block_dirty_folio) - * - * ->i_mmap_rwsem - * ->tasklist_lock (memory_failure, collect_procs_ao) */ static void page_cache_delete(struct address_space *mapping, diff --git a/mm/ksm.c b/mm/ksm.c index 8d6aee05421d..981af9c72e7a 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -2925,7 +2925,7 @@ void collect_procs_ksm(struct page *page, struct list_head *to_kill, struct anon_vma *av = rmap_item->anon_vma; anon_vma_lock_read(av); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process(tsk) { struct anon_vma_chain *vmac; unsigned long addr; @@ -2944,7 +2944,7 @@ void collect_procs_ksm(struct page *page, struct list_head *to_kill, } } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); anon_vma_unlock_read(av); } } diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 7b01fffe7a79..3e4fd8beec31 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -546,24 +546,26 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail, * Find a dedicated thread which is supposed to handle SIGBUS(BUS_MCEERR_AO) * on behalf of the thread group. Return task_struct of the (first found) * dedicated thread if found, and return NULL otherwise. - * - * We already hold read_lock(&tasklist_lock) in the caller, so we don't - * have to call rcu_read_lock/unlock() in this function. */ static struct task_struct *find_early_kill_thread(struct task_struct *tsk) { struct task_struct *t; + rcu_read_lock(); for_each_thread(tsk, t) { if (t->flags & PF_MCE_PROCESS) { if (t->flags & PF_MCE_EARLY) - return t; + goto found; } else { if (sysctl_memory_failure_early_kill) - return t; + goto found; } } - return NULL; + + t = NULL; +found: + rcu_read_unlock(); + return t; } /* @@ -609,7 +611,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, return; pgoff = page_to_pgoff(page); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process(tsk) { struct anon_vma_chain *vmac; struct task_struct *t = task_early_kill(tsk, force_early); @@ -626,7 +628,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, add_to_kill_anon_file(t, page, vma, to_kill); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); anon_vma_unlock_read(av); } @@ -642,7 +644,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, pgoff_t pgoff; i_mmap_lock_read(mapping); - read_lock(&tasklist_lock); + rcu_read_lock(); pgoff = page_to_pgoff(page); for_each_process(tsk) { struct task_struct *t = task_early_kill(tsk, force_early); @@ -662,7 +664,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, add_to_kill_anon_file(t, page, vma, to_kill); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); i_mmap_unlock_read(mapping); } @@ -685,7 +687,7 @@ static void collect_procs_fsdax(struct page *page, struct task_struct *tsk; i_mmap_lock_read(mapping); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process(tsk) { struct task_struct *t = task_early_kill(tsk, true); @@ -696,7 +698,7 @@ static void collect_procs_fsdax(struct page *page, add_to_kill_fsdax(t, page, vma, to_kill, pgoff); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); i_mmap_unlock_read(mapping); } #endif /* CONFIG_FS_DAX */