Skip to contentSkip to conversation

cpuset: fix RCU lockdep splat

PATCH New Li Zefan 2 participants 4 messages Jan 15, 2013 cgroup

lore
Share & tools
lore

Li Zefan

author
#0 lore raw

PATCH 1/2 cpuset: fix RCU lockdep splat

Reading /proc/<pid>/cpuset triggered RCU warning, and this bug was introduced by Commit 5d21cc2db040d01f8c19b8602f6987813e1176b4 ("cpuset: replace cgroup_mutex locking with cpuset internal locking")

Here we can retreive tsk->cgroups and call cgroup_path() inside RCU read section.

Reported-by Sasha Levin <[email protected]>
Signed-off-by Li Zefan <[email protected]>
---
 kernel/cpuset.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/cpuset.c +4 -4
index 6aa5bbb..1a675e4 100644
@@ -2678,15 +2678,15 @@ static int proc_cpuset_show(struct seq_file *m, void *unused_v)
 		goto out_free;
 
 	retval = -EINVAL;
-	mutex_lock(&cpuset_mutex);
+	rcu_read_lock();
 	css = task_subsys_state(tsk, cpuset_subsys_id);
 	retval = cgroup_path(css->cgroup, buf, PAGE_SIZE);
+	rcu_read_unlock();
 	if (retval < 0)
-		goto out_unlock;
+		goto out_put_task;
 	seq_puts(m, buf);
 	seq_putc(m, '\n');
-out_unlock:
-	mutex_unlock(&cpuset_mutex);
+out_put_task:
 	put_task_struct(tsk);
 out_free:
 	kfree(buf);
Signature · 1 line
1.8.0.2
author
#1 lore raw

PATCH 2/2 cpuset: return the return value of cgroup_path() to userspace

-EINVAL is improper, as we don't accept user inputs.

Signed-off-by Li Zefan <[email protected]>
---
 kernel/cpuset.c | 1 -
 1 file changed, 1 deletion(-)
kernel/cpuset.c +0 -1
index 1a675e4..16be7c9 100644
@@ -2677,7 +2677,6 @@ static int proc_cpuset_show(struct seq_file *m, void *unused_v)
 	if (!tsk)
 		goto out_free;
 
-	retval = -EINVAL;
 	rcu_read_lock();
 	css = task_subsys_state(tsk, cpuset_subsys_id);
 	retval = cgroup_path(css->cgroup, buf, PAGE_SIZE);
Signature · 1 line
1.8.0.2
maintainer
#2 lore raw

PATCH 2/2 cpuset: drop spurious retval assignment in proc_cpuset_show()

From d127027baf98dce3ca31bec18c2c0e048ceda7c4 Mon Sep 17 00:00:00 2001
From: Li Zefan <[email protected]>
Date: Tue, 15 Jan 2013 14:11:32 +0800

proc_cpuset_show() has a spurious -EINVAL assignment which does nothing. Remove it.

This patch doesn't make any functional difference.

tj: Rewrote patch description.

Signed-off-by Li Zefan <[email protected]>
Signed-off-by Tejun Heo <[email protected]>

---
Ditto. Thanks!

 kernel/cpuset.c | 1 -
 1 file changed, 1 deletion(-)
kernel/cpuset.c +0 -1
index 1a675e4..16be7c9 100644
@@ -2677,7 +2677,6 @@ static int proc_cpuset_show(struct seq_file *m, void *unused_v)
 	if (!tsk)
 		goto out_free;
 
-	retval = -EINVAL;
 	rcu_read_lock();
 	css = task_subsys_state(tsk, cpuset_subsys_id);
 	retval = cgroup_path(css->cgroup, buf, PAGE_SIZE);
Signature · 1 line
1.8.0.2
maintainer
#3 lore raw

PATCH 1/2 cpuset: fix RCU lockdep splat

In reply to Li Zefan

From 27e89ae5d6e94e30231ee89a7736f62d84ba4c6f Mon Sep 17 00:00:00 2001
From: Li Zefan <[email protected]>
Date: Tue, 15 Jan 2013 14:10:57 +0800

5d21cc2db040d01f8c19b8602f6987813e1176b4 ("cpuset: replace cgroup_mutex locking with cpuset internal locking") incorrectly converted proc_cpuset_show() from cgroup_lock() to cpuset_mutex. proc_cpuset_show() is accessing cgroup hierarchy proper to determine cgroup path which can't be protected by cpuset_mutex. This triggered the following RCU warning.

===============================
[ INFO: suspicious RCU usage. ]
3.8.0-rc3-next-20130114-sasha-00016-ga107525-dirty #262 Tainted: G W
-------------------------------
include/linux/cgroup.h:534 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 1
2 locks held by trinity/7514:
#0: (&p->lock){+.+.+.}, at: [<ffffffff812b06aa>] seq_read+0x3a/0x3e0 #1: (cpuset_mutex){+.+...}, at: [<ffffffff811abae4>] proc_cpuset_show+0x84/0x190

 stack backtrace:
 Pid: 7514, comm: trinity Tainted: G        W
+3.8.0-rc3-next-20130114-sasha-00016-ga107525-dirty #262
 Call Trace:
  [<ffffffff81182cab>] lockdep_rcu_suspicious+0x10b/0x120
  [<ffffffff811abb71>] proc_cpuset_show+0x111/0x190
  [<ffffffff812b0827>] seq_read+0x1b7/0x3e0
  [<ffffffff812b0670>] ? seq_lseek+0x110/0x110
  [<ffffffff8128b4fb>] do_loop_readv_writev+0x4b/0x90
  [<ffffffff8128b776>] do_readv_writev+0xf6/0x1d0
  [<ffffffff8128b8ee>] vfs_readv+0x3e/0x60
  [<ffffffff8128b960>] sys_readv+0x50/0xd0
  [<ffffffff83d33d18>] tracesys+0xe1/0xe6

The operation can be performed under RCU read lock. Replace cpuset_mutex locking with RCU read locking.

tj: Rewrote patch description.

Reported-by Sasha Levin <[email protected]>
Signed-off-by Li Zefan <[email protected]>
Signed-off-by Tejun Heo <[email protected]>

---
I rewrote the patch description for clarity and commited it to cgroup/for-3.9-cpuset.

Thanks.

 kernel/cpuset.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/cpuset.c +4 -4
index 6aa5bbb..1a675e4 100644
@@ -2678,15 +2678,15 @@ static int proc_cpuset_show(struct seq_file *m, void *unused_v)
 		goto out_free;
 
 	retval = -EINVAL;
-	mutex_lock(&cpuset_mutex);
+	rcu_read_lock();
 	css = task_subsys_state(tsk, cpuset_subsys_id);
 	retval = cgroup_path(css->cgroup, buf, PAGE_SIZE);
+	rcu_read_unlock();
 	if (retval < 0)
-		goto out_unlock;
+		goto out_put_task;
 	seq_puts(m, buf);
 	seq_putc(m, '\n');
-out_unlock:
-	mutex_unlock(&cpuset_mutex);
+out_put_task:
 	put_task_struct(tsk);
 out_free:
 	kfree(buf);
Signature · 1 line
1.8.0.2