The soft lockup below happens at the boot time of the system using dm
multipath and the udev rules to switch scheduler.
[ 356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483]
[ 356.127001] RIP: 0010:[<ffffffff81072a7d>] [<ffffffff81072a7d>] lock_timer_base.isra.35+0x1d/0x50
...
[ 356.127001] Call Trace:
[ 356.127001] [<ffffffff81073810>] try_to_del_timer_sync+0x20/0x70
[ 356.127001] [<ffffffff8118b08a>] ? kmem_cache_alloc_node_trace+0x20a/0x230
[ 356.127001] [<ffffffff810738b2>] del_timer_sync+0x52/0x60
[ 356.127001] [<ffffffff812ece22>] cfq_exit_queue+0x32/0xf0
[ 356.127001] [<ffffffff812c98df>] elevator_exit+0x2f/0x50
[ 356.127001] [<ffffffff812c9f21>] elevator_change+0xf1/0x1c0
[ 356.127001] [<ffffffff812caa50>] elv_iosched_store+0x20/0x50
[ 356.127001] [<ffffffff812d1d09>] queue_attr_store+0x59/0xb0
[ 356.127001] [<ffffffff812143f6>] sysfs_write_file+0xc6/0x140
[ 356.127001] [<ffffffff811a326d>] vfs_write+0xbd/0x1e0
[ 356.127001] [<ffffffff811a3ca9>] SyS_write+0x49/0xa0
[ 356.127001] [<ffffffff8164e899>] system_call_fastpath+0x16/0x1b
This is caused by a race between md device initialization by multipathd and
shell script to switch the scheduler using sysfs.
- multipathd:
SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load
-> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init
q->elevator = elevator_alloc(q, e); // not yet initialized
- sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler':
elevator_switch (in the call trace above)
struct elevator_queue *old = q->elevator;
q->elevator = elevator_alloc(q, new_e);
elevator_exit(old); // lockup! (*)
- multipathd: (cont.)
err = e->ops.elevator_init_fn(q); // init fails; q->elevator is modified
(*) When del_timer_sync() is called, lock_timer_base() will loop infinitely
while timer->base == NULL. In this case, as timer will never initialized,
it results in lockup.
This patch introduces acquisition of q->sysfs_lock around elevator_init()
into blk_init_allocated_queue(), to provide mutual exclusion between
initialization of the q->scheduler and switching of the scheduler.
This should fix this bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=902012
Signed-off-by: Tomoki Sekiyama <[email protected]>
---
block/blk-core.c | 10 +++++++++-
block/elevator.c | 6 ++++++
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/block/blk-core.c b/block/blk-core.c
index 93a18d1..2f6275f 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
q->sg_reserved_size = INT_MAX;
+ /* Protect q->elevator from elevator_change */
+ mutex_lock(&q->sysfs_lock);
+
/* init elevator */
- if (elevator_init(q, NULL))
+ if (elevator_init(q, NULL)) {
+ mutex_unlock(&q->sysfs_lock);
return NULL;
+ }
+
+ mutex_unlock(&q->sysfs_lock);
+
return q;
}
EXPORT_SYMBOL(blk_init_allocated_queue);
diff --git a/block/elevator.c b/block/elevator.c
index 668394d..02d4390 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char *name)
struct elevator_type *e = NULL;
int err;
+ /*
+ * q->sysfs_lock must be held to provide mutual exclusion between
+ * elevator_switch() and here.
+ */
+ lockdep_assert_held(&q->sysfs_lock);
+
if (unlikely(q->elevator))
return 0;
Add locking of q->sysfs_lock into elevator_change() (an exported function)
to ensure it is held to protect q->elevator from elevator_init(), even if
elevator_change() is called from non-sysfs paths.
sysfs path (elv_iosched_store) uses __elevator_change(), non-locking
version, as the lock is already taken by elv_iosched_store().
Signed-off-by: Tomoki Sekiyama <[email protected]>
---
block/elevator.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/block/elevator.c b/block/elevator.c
index 02d4390..6d765f7 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -965,7 +965,7 @@ fail_init:
/*
* Switch this queue to the given IO scheduler.
*/
-int elevator_change(struct request_queue *q, const char *name)
+static int __elevator_change(struct request_queue *q, const char *name)
{
char elevator_name[ELV_NAME_MAX];
struct elevator_type *e;
@@ -987,6 +987,18 @@ int elevator_change(struct request_queue *q, const char *name)
return elevator_switch(q, e);
}
+
+int elevator_change(struct request_queue *q, const char *name)
+{
+ int ret;
+
+ /* Protect q->elevator from elevator_init() */
+ mutex_lock(&q->sysfs_lock);
+ ret = __elevator_change(q, name);
+ mutex_unlock(&q->sysfs_lock);
+
+ return ret;
+}
EXPORT_SYMBOL(elevator_change);
ssize_t elv_iosched_store(struct request_queue *q, const char *name,
@@ -997,7 +1009,7 @@ ssize_t elv_iosched_store(struct request_queue *q, const char *name,
if (!q->elevator)
return count;
- ret = elevator_change(q, name);
+ ret = __elevator_change(q, name);
if (!ret)
return count;
Ping: any comments for this series?
On 8/30/13 18:47 , "Tomoki Sekiyama" <[email protected]> wrote:
>The soft lockup below happens at the boot time of the system using dm
>multipath and the udev rules to switch scheduler.
>
>[ 356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483]
>[ 356.127001] RIP: 0010:[<ffffffff81072a7d>] [<ffffffff81072a7d>]
>lock_timer_base.isra.35+0x1d/0x50
>...
>[ 356.127001] Call Trace:
>[ 356.127001] [<ffffffff81073810>] try_to_del_timer_sync+0x20/0x70
>[ 356.127001] [<ffffffff8118b08a>] ?
>kmem_cache_alloc_node_trace+0x20a/0x230
>[ 356.127001] [<ffffffff810738b2>] del_timer_sync+0x52/0x60
>[ 356.127001] [<ffffffff812ece22>] cfq_exit_queue+0x32/0xf0
>[ 356.127001] [<ffffffff812c98df>] elevator_exit+0x2f/0x50
>[ 356.127001] [<ffffffff812c9f21>] elevator_change+0xf1/0x1c0
>[ 356.127001] [<ffffffff812caa50>] elv_iosched_store+0x20/0x50
>[ 356.127001] [<ffffffff812d1d09>] queue_attr_store+0x59/0xb0
>[ 356.127001] [<ffffffff812143f6>] sysfs_write_file+0xc6/0x140
>[ 356.127001] [<ffffffff811a326d>] vfs_write+0xbd/0x1e0
>[ 356.127001] [<ffffffff811a3ca9>] SyS_write+0x49/0xa0
>[ 356.127001] [<ffffffff8164e899>] system_call_fastpath+0x16/0x1b
>
>This is caused by a race between md device initialization by multipathd
>and
>shell script to switch the scheduler using sysfs.
>
> - multipathd:
> SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load
> -> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init
> q->elevator = elevator_alloc(q, e); // not yet initialized
>
> - sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler':
> elevator_switch (in the call trace above)
> struct elevator_queue *old = q->elevator;
> q->elevator = elevator_alloc(q, new_e);
> elevator_exit(old); // lockup! (*)
>
> - multipathd: (cont.)
> err = e->ops.elevator_init_fn(q); // init fails; q->elevator is
>modified
>
>(*) When del_timer_sync() is called, lock_timer_base() will loop
>infinitely
>while timer->base == NULL. In this case, as timer will never initialized,
>it results in lockup.
>
>This patch introduces acquisition of q->sysfs_lock around elevator_init()
>into blk_init_allocated_queue(), to provide mutual exclusion between
>initialization of the q->scheduler and switching of the scheduler.
>
>This should fix this bugzilla:
>https://bugzilla.redhat.com/show_bug.cgi?id=902012
>
>Signed-off-by: Tomoki Sekiyama <[email protected]>
>---
> block/blk-core.c | 10 +++++++++-
> block/elevator.c | 6 ++++++
> 2 files changed, 15 insertions(+), 1 deletion(-)
>
>diff --git a/block/blk-core.c b/block/blk-core.c
>index 93a18d1..2f6275f 100644
>--- a/block/blk-core.c
>+++ b/block/blk-core.c
>@@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q,
>request_fn_proc *rfn,
>
> q->sg_reserved_size = INT_MAX;
>
>+ /* Protect q->elevator from elevator_change */
>+ mutex_lock(&q->sysfs_lock);
>+
> /* init elevator */
>- if (elevator_init(q, NULL))
>+ if (elevator_init(q, NULL)) {
>+ mutex_unlock(&q->sysfs_lock);
> return NULL;
>+ }
>+
>+ mutex_unlock(&q->sysfs_lock);
>+
> return q;
> }
> EXPORT_SYMBOL(blk_init_allocated_queue);
>diff --git a/block/elevator.c b/block/elevator.c
>index 668394d..02d4390 100644
>--- a/block/elevator.c
>+++ b/block/elevator.c
>@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char
>*name)
> struct elevator_type *e = NULL;
> int err;
>
>+ /*
>+ * q->sysfs_lock must be held to provide mutual exclusion between
>+ * elevator_switch() and here.
>+ */
>+ lockdep_assert_held(&q->sysfs_lock);
>+
> if (unlikely(q->elevator))
> return 0;
>
>
On Fri, Aug 30, 2013 at 06:47:16PM -0400, Tomoki Sekiyama wrote:
> Add locking of q->sysfs_lock into elevator_change() (an exported function)
> to ensure it is held to protect q->elevator from elevator_init(), even if
> elevator_change() is called from non-sysfs paths.
> sysfs path (elv_iosched_store) uses __elevator_change(), non-locking
> version, as the lock is already taken by elv_iosched_store().
>
> Signed-off-by: Tomoki Sekiyama <[email protected]>
Acked-by: Tejun Heo <[email protected]>
Thanks.
--
tejun
On Fri, Aug 30, 2013 at 06:47:07PM -0400, Tomoki Sekiyama wrote:
> @@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
>
> q->sg_reserved_size = INT_MAX;
>
> + /* Protect q->elevator from elevator_change */
> + mutex_lock(&q->sysfs_lock);
> +
> /* init elevator */
> - if (elevator_init(q, NULL))
> + if (elevator_init(q, NULL)) {
> + mutex_unlock(&q->sysfs_lock);
> return NULL;
> + }
> +
> + mutex_unlock(&q->sysfs_lock);
> +
> return q;
> }
> EXPORT_SYMBOL(blk_init_allocated_queue);
> diff --git a/block/elevator.c b/block/elevator.c
> index 668394d..02d4390 100644
> --- a/block/elevator.c
> +++ b/block/elevator.c
> @@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char *name)
> struct elevator_type *e = NULL;
> int err;
>
> + /*
> + * q->sysfs_lock must be held to provide mutual exclusion between
> + * elevator_switch() and here.
> + */
> + lockdep_assert_held(&q->sysfs_lock);
> +
> if (unlikely(q->elevator))
> return 0;
Hmm... why aren't we just changing elevator_init() to grab sysfs_lock
where necessary? It'd be more consistent with elevator_exit() that
way.
Thanks.
--
tejun
Hi Tejun,
Thank you for the review.
On 9/22/13 13:04 , "Tejun Heo" <[email protected]> wrote:
>On Fri, Aug 30, 2013 at 06:47:07PM -0400, Tomoki Sekiyama wrote:
>> @@ -739,9 +739,17 @@ blk_init_allocated_queue(struct request_queue *q,
>>request_fn_proc *rfn,
>>
>> q->sg_reserved_size = INT_MAX;
>>
>> + /* Protect q->elevator from elevator_change */
>> + mutex_lock(&q->sysfs_lock);
>> +
>> /* init elevator */
>> - if (elevator_init(q, NULL))
>> + if (elevator_init(q, NULL)) {
>> + mutex_unlock(&q->sysfs_lock);
>> return NULL;
>> + }
>> +
>> + mutex_unlock(&q->sysfs_lock);
>> +
>> return q;
>> }
>> EXPORT_SYMBOL(blk_init_allocated_queue);
>> diff --git a/block/elevator.c b/block/elevator.c
>> index 668394d..02d4390 100644
>> --- a/block/elevator.c
>> +++ b/block/elevator.c
>> @@ -186,6 +186,12 @@ int elevator_init(struct request_queue *q, char
>>*name)
>> struct elevator_type *e = NULL;
>> int err;
>>
>> + /*
>> + * q->sysfs_lock must be held to provide mutual exclusion between
>> + * elevator_switch() and here.
>> + */
>> + lockdep_assert_held(&q->sysfs_lock);
>> +
>> if (unlikely(q->elevator))
>> return 0;
>
>Hmm... why aren't we just changing elevator_init() to grab sysfs_lock
>where necessary?
The locking cannot be moved into elevator_init() because it is called
from elevator_switch() path, where the request_queue's sysfs_lock is
already taken.
> It'd be more consistent with elevator_exit() that way.
What elevator_exit() locks is elevator_queue's sysfs_lock, not
request_queue's sysfs_lock. What we need here is request_queue's
sysfs_lock.
>Thanks.
>
>--
>Tejun
Thanks,
Tomoki Sekiyama
Hello,
On Mon, Sep 23, 2013 at 08:11:55PM +0000, Tomoki Sekiyama wrote:
> >Hmm... why aren't we just changing elevator_init() to grab sysfs_lock
> >where necessary?
>
> The locking cannot be moved into elevator_init() because it is called
> from elevator_switch() path, where the request_queue's sysfs_lock is
> already taken.
>
> > It'd be more consistent with elevator_exit() that way.
>
> What elevator_exit() locks is elevator_queue's sysfs_lock, not
> request_queue's sysfs_lock. What we need here is request_queue's
> sysfs_lock.
Ah, okay.
Reviewed-by: Tejun Heo <[email protected]>
Thanks.
--
tejun
Hi all,
Is this patchset going to be merged into 3.12?
Thanks,
--
Tomoki
On 9/23/13 16:14 , "Tejun Heo" <[email protected]> wrote:
>Hello,
>
>On Mon, Sep 23, 2013 at 08:11:55PM +0000, Tomoki Sekiyama wrote:
>> >Hmm... why aren't we just changing elevator_init() to grab sysfs_lock
>> >where necessary?
>>
>> The locking cannot be moved into elevator_init() because it is called
>> from elevator_switch() path, where the request_queue's sysfs_lock is
>> already taken.
>>
>> > It'd be more consistent with elevator_exit() that way.
>>
>> What elevator_exit() locks is elevator_queue's sysfs_lock, not
>> request_queue's sysfs_lock. What we need here is request_queue's
>> sysfs_lock.
>
>Ah, okay.
>
> Reviewed-by: Tejun Heo <[email protected]>
>
>Thanks.
>
>--
>tejun