From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.5 required=3.0 tests=FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4DDCC352BE for ; Wed, 15 Apr 2020 03:17:17 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 89A09206F9 for ; Wed, 15 Apr 2020 03:17:17 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 89A09206F9 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 209748E0005; Tue, 14 Apr 2020 23:17:17 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1B99A8E0001; Tue, 14 Apr 2020 23:17:17 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0D00F8E0005; Tue, 14 Apr 2020 23:17:17 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0207.hostedemail.com [216.40.44.207]) by kanga.kvack.org (Postfix) with ESMTP id E88388E0001 for ; Tue, 14 Apr 2020 23:17:16 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id A9158824556B for ; Wed, 15 Apr 2020 03:17:16 +0000 (UTC) X-FDA: 76708628472.25.wash89_5bdd58ee39d40 X-HE-Tag: wash89_5bdd58ee39d40 X-Filterd-Recvd-Size: 3441 Received: from mail3-166.sinamail.sina.com.cn (mail3-166.sinamail.sina.com.cn [202.108.3.166]) by imf13.hostedemail.com (Postfix) with SMTP for ; Wed, 15 Apr 2020 03:17:07 +0000 (UTC) Received: from unknown (HELO localhost.localdomain)([221.219.5.127]) by sina.com with ESMTP id 5E967C7C0001C303; Wed, 15 Apr 2020 11:16:16 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com X-SMAIL-MID: 32213554920373 From: Hillf Danton To: Jason Gunthorpe Cc: Peter Xu , Brian Geffon , Andrea Arcangeli , linux-mm , LKML , Sonny Rao Subject: Re: Userfaultfd doesn't seem to break out of poll on fd close Date: Wed, 15 Apr 2020 11:16:02 +0800 Message-Id: <20200415031602.22348-1-hdanton@sina.com> In-Reply-To: <20200414214516.GA182757@xz-x1> References: <20200414214516.GA182757@xz-x1> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, 14 Apr 2020 19:34:10 -0300 Jason Gunthorpe wrote: >=20 > On Tue, Apr 14, 2020 at 05:45:16PM -0400, Peter Xu wrote: > > On Sun, Apr 12, 2020 at 01:10:40PM -0700, Brian Geffon wrote: > > > Hi, > > > It seems that userfaultfd isn't woken from a poll when the file > > > descriptor is closed. It seems that it should be from the code in > > > userfault_ctx_release, but it appears that's not actually called > > > immediately. I have a simple standalone example that shows this > > > behavior. It's straight forward: one thread creates a userfaultfd a= nd > > > then closes it after a second thread has entered a poll syscall, so= me > > > abbreviated strace output is below showing this and the code can be > > > seen here: https://gist.github.com/bgaff/9a8fbbe8af79c0e18502430d41= 6df77e > > >=20 > > > Given that it's probably very common to have a dedicated thread rem= ain > > > blocked indefinitely in a poll(2) waiting for faults there must be = a > > > way to break it out early when it's closed. Am I missing something? > >=20 > > Hi, Brian, > >=20 > > I might be wrong below, just to share my understanding... > >=20 > > IMHO a well-behaved userspace should not close() on a file descriptor > > if it's still in use within another thread. In this case, the poll() > > thread is still using the userfaultfd handle >=20 > I also don't think concurrant close() on a file descriptor that is > under poll() is well defined, or should be relied upon. >=20 > > IIUC userfaultfd_release() is only called when the file descriptor > > destructs itself. But shouldn't the poll() take a refcount of that > > file descriptor too before waiting? Not sure userfaultfd_release() i= s > > the place to kick then, because if so, close() will only decrease the > > fd refcount from 2->1, and I'm not sure userfaultfd_release() will be > > triggered. >=20 > This is most probably true. >=20 > eventfd, epoll and pthread_join is the robust answer to these > problems. >=20 See the difference EPOLLHUP makes. --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -937,7 +937,7 @@ wakeup: /* Flush pending events that may still wait on event_wqh */ wake_up_all(&ctx->event_wqh); =20 - wake_up_poll(&ctx->fd_wqh, EPOLLHUP); + wake_up_all(&ctx->fd_wqh); userfaultfd_ctx_put(ctx); return 0; }