elevator: Fix a race in elevator switching and md device initialization

PATCH In review Tomoki Sekiyama 2 participants 8 messages Aug 30, 2013 – Oct 9, 2013 Block layer

lore

Share & tools

lore

Tomoki Sekiyama

author

2013-08-30 22:47 UTC #0 lore raw

PATCH v2 1/2 elevator: Fix a race in elevator switching and md device initialization

The soft lockup below happens at the boot time of the system using dm multipath and the udev rules to switch scheduler.

[  356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483]
[  356.127001] RIP: 0010:[<ffffffff81072a7d>]  [<ffffffff81072a7d>] lock_timer_base.isra.35+0x1d/0x50
...
[  356.127001] Call Trace:
[  356.127001]  [<ffffffff81073810>] try_to_del_timer_sync+0x20/0x70
[  356.127001]  [<ffffffff8118b08a>] ? kmem_cache_alloc_node_trace+0x20a/0x230
[  356.127001]  [<ffffffff810738b2>] del_timer_sync+0x52/0x60
[  356.127001]  [<ffffffff812ece22>] cfq_exit_queue+0x32/0xf0
[  356.127001]  [<ffffffff812c98df>] elevator_exit+0x2f/0x50
[  356.127001]  [<ffffffff812c9f21>] elevator_change+0xf1/0x1c0
[  356.127001]  [<ffffffff812caa50>] elv_iosched_store+0x20/0x50
[  356.127001]  [<ffffffff812d1d09>] queue_attr_store+0x59/0xb0
[  356.127001]  [<ffffffff812143f6>] sysfs_write_file+0xc6/0x140
[  356.127001]  [<ffffffff811a326d>] vfs_write+0xbd/0x1e0
[  356.127001]  [<ffffffff811a3ca9>] SyS_write+0x49/0xa0
[  356.127001]  [<ffffffff8164e899>] system_call_fastpath+0x16/0x1b

This is caused by a race between md device initialization by multipathd and shell script to switch the scheduler using sysfs.

- multipathd:
SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load -> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init

    q->elevator = elevator_alloc(q, e); // not yet initialized

- sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler':
elevator_switch (in the call trace above)

    struct elevator_queue *old = q->elevator;
    q->elevator = elevator_alloc(q, new_e);
    elevator_exit(old);                 // lockup! (*)

- multipathd: (cont.)

    err = e->ops.elevator_init_fn(q);   // init fails; q->elevator is modified

(*) When del_timer_sync() is called, lock_timer_base() will loop infinitely while timer->base == NULL. In this case, as timer will never initialized, it results in lockup.

This patch introduces acquisition of q->sysfs_lock around elevator_init() into blk_init_allocated_queue(), to provide mutual exclusion between initialization of the q->scheduler and switching of the scheduler.

This should fix this bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=902012

Signed-off-by Tomoki Sekiyama <[email protected]>

---
 block/blk-core.c |   10 +++++++++-
 block/elevator.c |    6 ++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

block/blk-core.c +9 -1

index 93a18d1..2f6275f 100644
@@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 
 	q->sg_reserved_size = INT_MAX;
 
+	/* Protect q->elevator from elevator_change */
+	mutex_lock(&q->sysfs_lock);
+
 	/* init elevator */
-	if (elevator_init(q, NULL))
+	if (elevator_init(q, NULL)) {
+		mutex_unlock(&q->sysfs_lock);
 		return NULL;
+	}
+
+	mutex_unlock(&q->sysfs_lock);
+
 	return q;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);

block/elevator.c +6 -0

index 668394d..02d4390 100644
@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char *name)
 	struct elevator_type *e = NULL;
 	int err;
 
+	/*
+	 * q->sysfs_lock must be held to provide mutual exclusion between
+	 * elevator_switch() and here.
+	 */
+	lockdep_assert_held(&q->sysfs_lock);
+
 	if (unlikely(q->elevator))
 		return 0;

Tomoki Sekiyama

author

2013-08-30 22:47 UTC #1 lore raw

PATCH v2 2/2 elevator: acquire q->sysfs_lock in elevator_change()

Add locking of q->sysfs_lock into elevator_change() (an exported function) to ensure it is held to protect q->elevator from elevator_init(), even if elevator_change() is called from non-sysfs paths.
sysfs path (elv_iosched_store) uses __elevator_change(), non-locking version, as the lock is already taken by elv_iosched_store().

Signed-off-by Tomoki Sekiyama <[email protected]>

---
 block/elevator.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

block/elevator.c +14 -2

index 02d4390..6d765f7 100644
@@ -965,7 +965,7 @@ fail_init:
 /*
  * Switch this queue to the given IO scheduler.
  */
-int elevator_change(struct request_queue *q, const char *name)
+static int __elevator_change(struct request_queue *q, const char *name)
 {
 	char elevator_name[ELV_NAME_MAX];
 	struct elevator_type *e;

@@ -987,6 +987,18 @@ int elevator_change(struct request_queue *q, const char *name)
 
 	return elevator_switch(q, e);
 }
+
+int elevator_change(struct request_queue *q, const char *name)
+{
+	int ret;
+
+	/* Protect q->elevator from elevator_init() */
+	mutex_lock(&q->sysfs_lock);
+	ret = __elevator_change(q, name);
+	mutex_unlock(&q->sysfs_lock);
+
+	return ret;
+}
 EXPORT_SYMBOL(elevator_change);
 
 ssize_t elv_iosched_store(struct request_queue *q, const char *name,

@@ -997,7 +1009,7 @@ ssize_t elv_iosched_store(struct request_queue *q, const char *name,
 	if (!q->elevator)
 		return count;
 
-	ret = elevator_change(q, name);
+	ret = __elevator_change(q, name);
 	if (!ret)
 		return count;

Tejun Heo

Acked-by on v2 2/2

2013-09-22 17:00 UTC #2 lore raw

Re: [PATCH v2 2/2] elevator: acquire q->sysfs_lock in elevator_change()

Quoted 7 lines · Tomoki Sekiyama

Add locking of q->sysfs_lock into elevator_change() (an exported function) to ensure it is held to protect q->elevator from elevator_init(), even if elevator_change() is called from non-sysfs paths.
sysfs path (elv_iosched_store) uses __elevator_change(), non-locking version, as the lock is already taken by elv_iosched_store().
Signed-off-by Tomoki Sekiyama <[email protected]>

Acked-by Tejun Heo <[email protected]>

Thanks.

Signature · 1 line

tejun

Tomoki Sekiyama

author

2013-09-06 15:10 UTC #3 lore raw

In reply to Tomoki Sekiyama

Ping: any comments for this series?

Quoted 102 lines · Tomoki Sekiyama

The soft lockup below happens at the boot time of the system using dm multipath and the udev rules to switch scheduler.
[  356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483]
[  356.127001] RIP: 0010:[<ffffffff81072a7d>]  [<ffffffff81072a7d>]
lock_timer_base.isra.35+0x1d/0x50
...
[  356.127001] Call Trace:
[  356.127001]  [<ffffffff81073810>] try_to_del_timer_sync+0x20/0x70
[  356.127001]  [<ffffffff8118b08a>] ?
kmem_cache_alloc_node_trace+0x20a/0x230
[  356.127001]  [<ffffffff810738b2>] del_timer_sync+0x52/0x60
[  356.127001]  [<ffffffff812ece22>] cfq_exit_queue+0x32/0xf0
[  356.127001]  [<ffffffff812c98df>] elevator_exit+0x2f/0x50
[  356.127001]  [<ffffffff812c9f21>] elevator_change+0xf1/0x1c0
[  356.127001]  [<ffffffff812caa50>] elv_iosched_store+0x20/0x50
[  356.127001]  [<ffffffff812d1d09>] queue_attr_store+0x59/0xb0
[  356.127001]  [<ffffffff812143f6>] sysfs_write_file+0xc6/0x140
[  356.127001]  [<ffffffff811a326d>] vfs_write+0xbd/0x1e0
[  356.127001]  [<ffffffff811a3ca9>] SyS_write+0x49/0xa0
[  356.127001]  [<ffffffff8164e899>] system_call_fastpath+0x16/0x1b
This is caused by a race between md device initialization by multipathd and
shell script to switch the scheduler using sysfs.
- multipathd:
SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load -> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init
q->elevator = elevator_alloc(q, e); // not yet initialized
- sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler':
elevator_switch (in the call trace above)
struct elevator_queue *old = q->elevator; q->elevator = elevator_alloc(q, new_e);
elevator_exit(old); // lockup! (*)
- multipathd: (cont.)
err = e->ops.elevator_init_fn(q); // init fails; q->elevator is
modified
(*) When del_timer_sync() is called, lock_timer_base() will loop infinitely
while timer->base == NULL. In this case, as timer will never initialized, it results in lockup.
This patch introduces acquisition of q->sysfs_lock around elevator_init() into blk_init_allocated_queue(), to provide mutual exclusion between initialization of the q->scheduler and switching of the scheduler.
This should fix this bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=902012
Signed-off-by Tomoki Sekiyama <[email protected]>
---
block/blk-core.c | 10 +++++++++-
block/elevator.c | 6 ++++++
2 files changed, 15 insertions(+), 1 deletion(-)
block/blk-core.c +9 -1
index 93a18d1..2f6275f 100644
@@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q,
 request_fn_proc *rfn,
 
 	q->sg_reserved_size = INT_MAX;
 
+	/* Protect q->elevator from elevator_change */
+	mutex_lock(&q->sysfs_lock);
+
 	/* init elevator */
-	if (elevator_init(q, NULL))
+	if (elevator_init(q, NULL)) {
+		mutex_unlock(&q->sysfs_lock);
 		return NULL;
+	}
+
+	mutex_unlock(&q->sysfs_lock);
+
 	return q;
 }
EXPORT_SYMBOL(blk_init_allocated_queue);
block/elevator.c +6 -0
index 668394d..02d4390 100644
@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char
 *name)
 	struct elevator_type *e = NULL;
 	int err;
 
+	/*
+	 * q->sysfs_lock must be held to provide mutual exclusion between
+	 * elevator_switch() and here.
+	 */
+	lockdep_assert_held(&q->sysfs_lock);
+
 	if (unlikely(q->elevator))
 		return 0;

Tejun Heo

2013-09-22 17:04 UTC #4 lore raw

In reply to Tomoki Sekiyama

Quoted 25 lines · Tomoki Sekiyama

block/blk-core.c +9 -1

@@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
 
 	q->sg_reserved_size = INT_MAX;
 
+	/* Protect q->elevator from elevator_change */
+	mutex_lock(&q->sysfs_lock);
+
 	/* init elevator */
-	if (elevator_init(q, NULL))
+	if (elevator_init(q, NULL)) {
+		mutex_unlock(&q->sysfs_lock);
 		return NULL;
+	}
+
+	mutex_unlock(&q->sysfs_lock);
+
 	return q;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);

block/elevator.c +0 -0

index 668394d..02d4390 100644
@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char *name)
 	struct elevator_type *e = NULL;

block/elevator.c int elevator_init(struct request_queue *q, char *name) · line 196

Quoted 10 lines

block/elevator.c +6 -0

 	int err;
 
+	/*
+	 * q->sysfs_lock must be held to provide mutual exclusion between
+	 * elevator_switch() and here.
+	 */
+	lockdep_assert_held(&q->sysfs_lock);
+
 	if (unlikely(q->elevator))
 		return 0;

Hmm... why aren't we just changing elevator_init() to grab sysfs_lock where necessary? It'd be more consistent with elevator_exit() that way.

Thanks.

Signature · 1 line

tejun

Tomoki Sekiyama

author

2013-09-23 20:12 UTC #5 lore raw

Hi Tejun,

Thank you for the review.

Quoted 30 lines · Tejun Heo

Quoted 29 lines · Tomoki Sekiyama

block/blk-core.c +9 -1

@@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q,
 request_fn_proc *rfn,
 
 	q->sg_reserved_size = INT_MAX;
 
+	/* Protect q->elevator from elevator_change */
+	mutex_lock(&q->sysfs_lock);
+
 	/* init elevator */
-	if (elevator_init(q, NULL))
+	if (elevator_init(q, NULL)) {
+		mutex_unlock(&q->sysfs_lock);
 		return NULL;
+	}
+
+	mutex_unlock(&q->sysfs_lock);
+
 	return q;
 }

EXPORT_SYMBOL(blk_init_allocated_queue);

block/elevator.c +0 -0

index 668394d..02d4390 100644
@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char
 *name)
 	struct elevator_type *e = NULL;
 	int err;

Quoted 11 lines

block/elevator.c int elevator_init(struct request_queue *q, char *name) · line 196
Quoted 8 lines
block/elevator.c +6 -0
+	/*
+	 * q->sysfs_lock must be held to provide mutual exclusion between
+	 * elevator_switch() and here.
+	 */
+	lockdep_assert_held(&q->sysfs_lock);
+
 	if (unlikely(q->elevator))
 		return 0;
Hmm... why aren't we just changing elevator_init() to grab sysfs_lock where necessary?

The locking cannot be moved into elevator_init() because it is called from elevator_switch() path, where the request_queue's sysfs_lock is already taken.

Quoted 1 line

It'd be more consistent with elevator_exit() that way.

What elevator_exit() locks is elevator_queue's sysfs_lock, not request_queue's sysfs_lock. What we need here is request_queue's sysfs_lock.

Quoted 4 lines

Thanks.
Signature · 1 line
Tejun

Thanks,
Tomoki Sekiyama

Tejun Heo

Reviewed-by

2013-09-23 20:14 UTC #6 lore raw

Hello,

Quoted 7 lines · Tomoki Sekiyama

Quoted 2 lines
Hmm... why aren't we just changing elevator_init() to grab sysfs_lock where necessary?
The locking cannot be moved into elevator_init() because it is called from elevator_switch() path, where the request_queue's sysfs_lock is already taken.

Quoted 5 lines

Quoted 1 line
It'd be more consistent with elevator_exit() that way.
What elevator_exit() locks is elevator_queue's sysfs_lock, not request_queue's sysfs_lock. What we need here is request_queue's sysfs_lock.

Ah, okay.

Reviewed-by Tejun Heo <[email protected]>

Thanks.

Signature · 1 line

tejun

Tomoki Sekiyama

author

2013-10-09 22:41 UTC #7 lore raw

Hi all,

Is this patchset going to be merged into 3.12?

Thanks,

Signature · 1 line

Tomoki

Quoted 24 lines · Tejun Heo

Hello,
Quoted 7 lines · Tomoki Sekiyama
Quoted 2 lines
Hmm... why aren't we just changing elevator_init() to grab sysfs_lock where necessary?
The locking cannot be moved into elevator_init() because it is called from elevator_switch() path, where the request_queue's sysfs_lock is already taken.
Quoted 5 lines
Quoted 1 line
It'd be more consistent with elevator_exit() that way.
What elevator_exit() locks is elevator_queue's sysfs_lock, not request_queue's sysfs_lock. What we need here is request_queue's sysfs_lock.
Ah, okay.
Reviewed-by Tejun Heo <[email protected]>
Thanks.
Signature · 1 line
tejun