From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53469C27C7A for ; Thu, 17 Aug 2023 05:36:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A9ED5280019; Thu, 17 Aug 2023 01:36:43 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A4FF7280006; Thu, 17 Aug 2023 01:36:43 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 91791280019; Thu, 17 Aug 2023 01:36:43 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 7D872280006 for ; Thu, 17 Aug 2023 01:36:43 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 45EB71404F3 for ; Thu, 17 Aug 2023 05:36:43 +0000 (UTC) X-FDA: 81132487086.06.6B9FFA9 Received: from out-27.mta1.migadu.com (out-27.mta1.migadu.com [95.215.58.27]) by imf16.hostedemail.com (Postfix) with ESMTP id 41F4518000D for ; Thu, 17 Aug 2023 05:36:41 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Jqkb1wEi; spf=pass (imf16.hostedemail.com: domain of naoya.horiguchi@linux.dev designates 95.215.58.27 as permitted sender) smtp.mailfrom=naoya.horiguchi@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1692250601; a=rsa-sha256; cv=none; b=K1mlKw6UR+p0QH+M4aM1S9x97x4MEFx9vbDsf3HFDldAxLcwweX798N8FD61ykc43VKjUA 4bmbB1nakffHFg7cruv7deWA7RE6yCerNHnNfATHHKlKWclQwJp9ZlXkPDzEekV1VRTSSS X9yAhTP7nsSOQC6q4KwUVaJXB71ULHk= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Jqkb1wEi; spf=pass (imf16.hostedemail.com: domain of naoya.horiguchi@linux.dev designates 95.215.58.27 as permitted sender) smtp.mailfrom=naoya.horiguchi@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1692250601; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uK+R0U0084E3+ioqd6qX+1HxBOQ0SxAv8VxEItq01Os=; b=74K1IauAZ7TfkSsl92qTs8Dg/DnDPS3UQooHZB5FoOtZ6NIUBSs/3ImO2zQ8iDKFLikkbt X9RcwCml4HBJUrJj+ZAj8u9q4QNMQXGDZO3qal0meeGVTai1K/Nd+BmNYCrxqymYeidPda r3KtrbZNqs0TuOFQRmpZavH+zGQZyig= Date: Thu, 17 Aug 2023 14:36:30 +0900 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1692250599; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uK+R0U0084E3+ioqd6qX+1HxBOQ0SxAv8VxEItq01Os=; b=Jqkb1wEi/7vgZxbuen5SmpnYKbSOXIgjdeJGSP/y+QYeKVIyuF1ohqUDl0d8008q0t/1Z8 JbPbfpLfK8ypj7qtPJIo1s04RsmMqTkGBfroXM+6SAOr9lQDVAujg9dr2XZXPgDl9WcrHl W7O2prqKtJMOGUec2EMR7YLg6iHqVRQ= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Naoya Horiguchi To: Tong Tiangen Cc: Andrew Morton , Naoya Horiguchi , Miaohe Lin , linux-mm@kvack.org, linux-kernel@vger.kernel.org, wangkefeng.wang@huawei.com, Guohanjun Subject: Re: [RFC PATCH -next] mm: fix softlockup by replacing tasklist_lock with RCU in for_each_process() Message-ID: <20230817053630.GA461822@ik1-406-35019.vs.sakura.ne.jp> References: <20230815130154.1100779-1-tongtiangen@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20230815130154.1100779-1-tongtiangen@huawei.com> X-Migadu-Flow: FLOW_OUT X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 41F4518000D X-Stat-Signature: mcg47gki63cogxrhnjma1br715xxd675 X-Rspam-User: X-HE-Tag: 1692250601-867782 X-HE-Meta: U2FsdGVkX1+BiRpUzBd2wlza+Y/fZjCYO7ZYCxVtJC5M5ETYd0yVRDuISszACWfbKh4F568K5BUld3+VP1zZlyBw5Ci+ZipVg3bMggE9vzoOUhBGgk0RzWhM4S5qKWwRL0MiA8VR3h6024RrutiNPucmtaaEZri+1yiMShbTP7MRplgfmHnqR8QnQ78AIjgiA4yftm+scY88AasLCImsfJPJI0YaL8LYdXtMXtXVc4CC0wxiRrpgOvqzQOHYWMy3NmNWYCL5gWbPbNfcSHPLInMFnSirlBoBWutdu+bExiqCklqfnCQXr3+gNXkX5TIpGOD/uLh406EvTfo1PPNQ2+q01Dq/kfLPxzL6XbVhMHj2rWhQfHs6beLDWdw1WZqkgBvtmBmKoyBJ9CmA2jXWlxWANm5me73zaIf7ogFScf+Z9750EP8eCXW0R7jGrUWVC0gH+NGr85/UNE0yxdhVEJSPo64nu34qSOCKyV9l8dMi1lwbxXIgd3JPXg7loDUskfPHW9vxhgY6yZlR64qQZM4VyluvySI3mbgsg0PRPx7RzLQ/QbH5wf/d2WuJ3Q2l+stHagy04kXkagVpqCDuowX7G0h9iKFcjmwhMuuxHObYFMFUuqnZI8MI+cuoEjWaya15lUlJ0BVNq3kiHrvcas5tzU9ubX2lP9VFGx+4P1rnYTZHlEF28aKm1gT8dEFdV6rsq+l+nDocbnFXKc8prF/WLFqs0rK57jNzX564epzKBOC9PkJpyi5Kd8gRUNYi1ID2AHeIiPC62Ia9ClTopNOyR9ZTzx9VYygln8AgYJ2lgfifVBD0ltFsevb2W2aFp10c3MqR2kW5LJ236x0ozqVBaFnRGZcG1BWh4b/cA622LnmEqTB/Y506eGEkrRFSEojGrIwOeDtPRU0F4UCUIGAAsV0FHGaCEBenHyobZlw+GJ1Do0iA3nMOtStOJ9DxhO1WypcVR59FuhHa+WA ilG8l+s7 wgacAsiAE5snaR1F6K6jNw36CeH1fBkc1XuNLZEWVfjQvtmlD8TfVPFJ4/3Q7qZYn8WVrdHDg3FLg3f2XnwY8cRlOo52GMgl4N7BBD1nc+Mgz1cP3Xc0rCiHFtA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Aug 15, 2023 at 09:01:54PM +0800, Tong Tiangen wrote: > We found a softlock issue in our test, analyzed the logs, and found that > the relevant CPU call trace as follows: > > CPU0: > _do_fork > -> copy_process() > -> write_lock_irq(&tasklist_lock) //Disable irq,waiting for > //tasklist_lock > > CPU1: > wp_page_copy() > ->pte_offset_map_lock() > -> spin_lock(&page->ptl); //Hold page->ptl > -> ptep_clear_flush() > -> flush_tlb_others() ... > -> smp_call_function_many() > -> arch_send_call_function_ipi_mask() > -> csd_lock_wait() //Waiting for other CPUs respond > //IPI > > CPU2: > collect_procs_anon() > -> read_lock(&tasklist_lock) //Hold tasklist_lock > ->for_each_process(tsk) > -> page_mapped_in_vma() > -> page_vma_mapped_walk() > -> map_pte() > ->spin_lock(&page->ptl) //Waiting for page->ptl > > We can see that CPU1 waiting for CPU0 respond IPI，CPU0 waiting for CPU2 > unlock tasklist_lock, CPU2 waiting for CPU1 unlock page->ptl. As a result, > softlockup is triggered. > > For collect_procs_anon(), we will not modify the tasklist, but only perform > read traversal. Therefore, we can use rcu lock instead of spin lock > tasklist_lock, from this, we can break the softlock chain above. > > The same logic can also be applied to: > - collect_procs_file() > - collect_procs_fsdax() > - collect_procs_ksm() > - find_early_kill_thread() > > Signed-off-by: Tong Tiangen Hello Tiangen, thank you for finding the issue. mm/filemap.c mentions tasklist_lock in the comment about locking order, * ->i_mmap_rwsem * ->tasklist_lock (memory_failure, collect_procs_ao) so you can update this together? Otherwise looks good to me. Thanks, Naoya Horiguchi > --- > mm/ksm.c | 4 ++-- > mm/memory-failure.c | 36 ++++++++++++++++++++++-------------- > 2 files changed, 24 insertions(+), 16 deletions(-) > > diff --git a/mm/ksm.c b/mm/ksm.c > index 6b7b8928fb96..dcbc0c7f68e7 100644 > --- a/mm/ksm.c > +++ b/mm/ksm.c > @@ -2919,7 +2919,7 @@ void collect_procs_ksm(struct page *page, struct list_head *to_kill, > struct anon_vma *av = rmap_item->anon_vma; > > anon_vma_lock_read(av); > - read_lock(&tasklist_lock); > + rcu_read_lock(); > for_each_process(tsk) { > struct anon_vma_chain *vmac; > unsigned long addr; > @@ -2938,7 +2938,7 @@ void collect_procs_ksm(struct page *page, struct list_head *to_kill, > } > } > } > - read_unlock(&tasklist_lock); > + rcu_read_unlock(); > anon_vma_unlock_read(av); > } > } > diff --git a/mm/memory-failure.c b/mm/memory-failure.c > index 7b01fffe7a79..6a02706043f4 100644 > --- a/mm/memory-failure.c > +++ b/mm/memory-failure.c > @@ -546,24 +546,32 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail, > * Find a dedicated thread which is supposed to handle SIGBUS(BUS_MCEERR_AO) > * on behalf of the thread group. Return task_struct of the (first found) > * dedicated thread if found, and return NULL otherwise. > - * > - * We already hold read_lock(&tasklist_lock) in the caller, so we don't > - * have to call rcu_read_lock/unlock() in this function. > */ > static struct task_struct *find_early_kill_thread(struct task_struct *tsk) > { > struct task_struct *t; > + bool find = false; > > + rcu_read_lock(); > for_each_thread(tsk, t) { > if (t->flags & PF_MCE_PROCESS) { > - if (t->flags & PF_MCE_EARLY) > - return t; > + if (t->flags & PF_MCE_EARLY) { > + find = true; > + break; > + } > } else { > - if (sysctl_memory_failure_early_kill) > - return t; > + if (sysctl_memory_failure_early_kill) { > + find = true; > + break; > + } > } > } > - return NULL; > + rcu_read_unlock(); > + > + if (!find) > + t = NULL; > + > + return t; > } > > /* > @@ -609,7 +617,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, > return; > > pgoff = page_to_pgoff(page); > - read_lock(&tasklist_lock); > + rcu_read_lock(); > for_each_process(tsk) { > struct anon_vma_chain *vmac; > struct task_struct *t = task_early_kill(tsk, force_early); > @@ -626,7 +634,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, > add_to_kill_anon_file(t, page, vma, to_kill); > } > } > - read_unlock(&tasklist_lock); > + rcu_read_unlock(); > anon_vma_unlock_read(av); > } > > @@ -642,7 +650,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, > pgoff_t pgoff; > > i_mmap_lock_read(mapping); > - read_lock(&tasklist_lock); > + rcu_read_lock(); > pgoff = page_to_pgoff(page); > for_each_process(tsk) { > struct task_struct *t = task_early_kill(tsk, force_early); > @@ -662,7 +670,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, > add_to_kill_anon_file(t, page, vma, to_kill); > } > } > - read_unlock(&tasklist_lock); > + rcu_read_unlock(); > i_mmap_unlock_read(mapping); > } > > @@ -685,7 +693,7 @@ static void collect_procs_fsdax(struct page *page, > struct task_struct *tsk; > > i_mmap_lock_read(mapping); > - read_lock(&tasklist_lock); > + rcu_read_lock(); > for_each_process(tsk) { > struct task_struct *t = task_early_kill(tsk, true); > > @@ -696,7 +704,7 @@ static void collect_procs_fsdax(struct page *page, > add_to_kill_fsdax(t, page, vma, to_kill, pgoff); > } > } > - read_unlock(&tasklist_lock); > + rcu_read_unlock(); > i_mmap_unlock_read(mapping); > } > #endif /* CONFIG_FS_DAX */ > -- > 2.25.1 > > >