Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752134AbaFEUXn (ORCPT ); Thu, 5 Jun 2014 16:23:43 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:56947 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750840AbaFEUXl (ORCPT ); Thu, 5 Jun 2014 16:23:41 -0400 Date: Thu, 5 Jun 2014 13:23:39 -0700 From: Andrew Morton To: Gu Zheng Cc: linux-kernel , Tejun Heo , , Cgroups , Subject: Re: [PATCH] mm/mempolicy: fix sleeping function called from invalid context Message-Id: <20140605132339.ddf6df4a0cf5c14d17eb8691@linux-foundation.org> In-Reply-To: <53902A44.50005@cn.fujitsu.com> References: <53902A44.50005@cn.fujitsu.com> X-Mailer: Sylpheed 3.2.0beta5 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 5 Jun 2014 16:28:52 +0800 Gu Zheng wrote: > When running with the kernel(3.15-rc7+), the follow bug occurs: > [ 9969.258987] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:586 > [ 9969.359906] in_atomic(): 1, irqs_disabled(): 0, pid: 160655, name: python > [ 9969.441175] INFO: lockdep is turned off. > [ 9969.488184] CPU: 26 PID: 160655 Comm: python Tainted: G A 3.15.0-rc7+ #85 > [ 9969.581032] Hardware name: FUJITSU-SV PRIMEQUEST 1800E/SB, BIOS PRIMEQUEST 1000 Series BIOS Version 1.39 11/16/2012 > [ 9969.706052] ffffffff81a20e60 ffff8803e941fbd0 ffffffff8162f523 ffff8803e941fd18 > [ 9969.795323] ffff8803e941fbe0 ffffffff8109995a ffff8803e941fc58 ffffffff81633e6c > [ 9969.884710] ffffffff811ba5dc ffff880405c6b480 ffff88041fdd90a0 0000000000002000 > [ 9969.974071] Call Trace: > [ 9970.003403] [] dump_stack+0x4d/0x66 > [ 9970.065074] [] __might_sleep+0xfa/0x130 > [ 9970.130743] [] mutex_lock_nested+0x3c/0x4f0 > [ 9970.200638] [] ? kmem_cache_alloc+0x1bc/0x210 > [ 9970.272610] [] cpuset_mems_allowed+0x27/0x140 > [ 9970.344584] [] ? __mpol_dup+0x63/0x150 > [ 9970.409282] [] __mpol_dup+0xe5/0x150 > [ 9970.471897] [] ? __mpol_dup+0x63/0x150 > [ 9970.536585] [] ? copy_process.part.23+0x606/0x1d40 > [ 9970.613763] [] ? trace_hardirqs_on+0xd/0x10 > [ 9970.683660] [] ? monotonic_to_bootbased+0x2f/0x50 > [ 9970.759795] [] copy_process.part.23+0x670/0x1d40 > [ 9970.834885] [] do_fork+0xd8/0x380 > [ 9970.894375] [] ? __audit_syscall_entry+0x9c/0xf0 > [ 9970.969470] [] SyS_clone+0x16/0x20 > [ 9971.030011] [] stub_clone+0x69/0x90 > [ 9971.091573] [] ? system_call_fastpath+0x16/0x1b > > The cause is that cpuset_mems_allowed() try to take mutex_lock(&callback_mutex) > under the rcu_read_lock(which was hold in __mpol_dup()). And in cpuset_mems_allowed(), > the access to cpuset is under rcu_read_lock, so in __mpol_dup, we can reduce the > rcu_read_lock protection region to protect the access to cpuset only in > current_cpuset_is_being_rebound(). So that we can avoid this bug. > > ... > > --- a/kernel/cpuset.c > +++ b/kernel/cpuset.c > @@ -1188,7 +1188,13 @@ done: > > int current_cpuset_is_being_rebound(void) > { > - return task_cs(current) == cpuset_being_rebound; > + int ret; > + > + rcu_read_lock(); > + ret = task_cs(current) == cpuset_being_rebound; > + rcu_read_unlock(); > + > + return ret; > } Looks fishy to me. If the rcu_read_lock() stabilizes cpuset_being_rebound then cpuset_being_rebound can change immediately after rcu_read_unlock() and `ret' is now wrong. Anyway. Tejun, this one is yours please ;) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/