Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp2477515yba; Mon, 15 Apr 2019 12:28:15 -0700 (PDT) X-Google-Smtp-Source: APXvYqz734+ExQghBFScUyMsRUTQgPjor1o8QFGh24RSH2FE5nCC95gF4Eqqt0B5sXWdggZfV6qx X-Received: by 2002:a63:7943:: with SMTP id u64mr71241473pgc.91.1555356495635; Mon, 15 Apr 2019 12:28:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1555356495; cv=none; d=google.com; s=arc-20160816; b=Ic/Qe6SdQKdwyPLzVim6grSELT842FhnG+CsvqwCWfnfepFpwxaLs+4R0r1dVZXGfv oNcYp/HHGxkYPSrPZKSkbIRI5NnZVAODEva5C7tz1gArNB1lcbbbTBHCopX13G/scdOP O6XqmP/TszTP5qsw127QrH5BYxQOqNxHVcpGdPJ3VtFDXo1dB/968HJlMlLo2mDYltR9 XWi5IsUyh14EP2H0ikRX5mg+heVhwbEmT60/KTGGzTWeJgO16+jxEPOnDsFIotknxHb1 MaBwfogaVx2kB/KSVqk/R5Z0OQjUXtla8aKig7I1Tbz/Kn2u310cWniw/EjRPdi7hOeh CgPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Hmd/qAoH9AQ7Ayvsx8EeP84DgKFFYUs2+2hlt7/RIQg=; b=qdmKsOiwwr1RSCYX/poHvjNvQfoucpSQ6/Hl7uDUL9n/8i6jHv7pr+R5Ixu7PNKdni /XYn5QT5mogwhUncvapvOCSxY66L3/rO0lP5EPRqZwEKhqbQIu2SD+nxWnGak/D09umi x/6OPMfRNwP3GoLMRJojsDTUz+ptR2+5b5Vxv4NEFIhqoY05LvWEkBDYF1NL44gIfBoi /xm4eAjAyKoa67KMRUyP8ObYxx6bejCdahByTmbZJPQj+HoM0N6P04tarKIFuT1EuH9J 8xLlKKuxsJGa6AtxiDNwNxsIg7wEB8+nhNzJ718iBsEu9J7BqvmOVtZyDSxw5ABSB8BQ 90wg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=uI+X0Szf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f2si45380667pgi.61.2019.04.15.12.27.59; Mon, 15 Apr 2019 12:28:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=uI+X0Szf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729555AbfDOTEc (ORCPT + 99 others); Mon, 15 Apr 2019 15:04:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:37492 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728821AbfDOTEa (ORCPT ); Mon, 15 Apr 2019 15:04:30 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F14FE218EA; Mon, 15 Apr 2019 19:04:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1555355069; bh=QkknSH5Yaj7Pu6YVk/+yBRx2CIS+qKfcq7CdHnkA6AQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uI+X0SzfIk0JekNMhMdHhVwOw/A4bm4tdp7wNxW58+BU0JixcljJpyN1c49RdNlws FwbU+vc8oc/iPGWK2aitTA02koW8kPrRt0r51UzMEZsiuaw+xwFQLzpj5J0EnK7G5L OnSuOb6PIzwh3MfzC2I8uEQ+USI1nu5Pq51oTUns= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mel Gorman , "Peter Zijlstra (Intel)" , Valentin Schneider , Linus Torvalds , Mike Galbraith , Thomas Gleixner , Ingo Molnar Subject: [PATCH 4.14 61/69] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation Date: Mon, 15 Apr 2019 20:59:19 +0200 Message-Id: <20190415183735.651526775@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190415183726.036654568@linuxfoundation.org> References: <20190415183726.036654568@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mel Gorman commit 0e9f02450da07fc7b1346c8c32c771555173e397 upstream. A NULL pointer dereference bug was reported on a distribution kernel but the same issue should be present on mainline kernel. It occured on s390 but should not be arch-specific. A partial oops looks like: Unable to handle kernel pointer dereference in virtual kernel address space ... Call Trace: ... try_to_wake_up+0xfc/0x450 vhost_poll_wakeup+0x3a/0x50 [vhost] __wake_up_common+0xbc/0x178 __wake_up_common_lock+0x9e/0x160 __wake_up_sync_key+0x4e/0x60 sock_def_readable+0x5e/0x98 The bug hits any time between 1 hour to 3 days. The dereference occurs in update_cfs_rq_h_load when accumulating h_load. The problem is that cfq_rq->h_load_next is not protected by any locking and can be updated by parallel calls to task_h_load. Depending on the compiler, code may be generated that re-reads cfq_rq->h_load_next after the check for NULL and then oops when reading se->avg.load_avg. The dissassembly showed that it was possible to reread h_load_next after the check for NULL. While this does not appear to be an issue for later compilers, it's still an accident if the correct code is generated. Full locking in this path would have high overhead so this patch uses READ_ONCE to read h_load_next only once and check for NULL before dereferencing. It was confirmed that there were no further oops after 10 days of testing. As Peter pointed out, it is also necessary to use WRITE_ONCE() to avoid any potential problems with store tearing. Signed-off-by: Mel Gorman Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Cc: Linus Torvalds Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Fixes: 685207963be9 ("sched: Move h_load calculation to task_h_load()") Link: https://lkml.kernel.org/r/20190319123610.nsivgf3mjbjjesxb@techsingularity.net Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman --- kernel/sched/fair.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7018,10 +7018,10 @@ static void update_cfs_rq_h_load(struct if (cfs_rq->last_h_load_update == now) return; - cfs_rq->h_load_next = NULL; + WRITE_ONCE(cfs_rq->h_load_next, NULL); for_each_sched_entity(se) { cfs_rq = cfs_rq_of(se); - cfs_rq->h_load_next = se; + WRITE_ONCE(cfs_rq->h_load_next, se); if (cfs_rq->last_h_load_update == now) break; } @@ -7031,7 +7031,7 @@ static void update_cfs_rq_h_load(struct cfs_rq->last_h_load_update = now; } - while ((se = cfs_rq->h_load_next) != NULL) { + while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) { load = cfs_rq->h_load; load = div64_ul(load * se->avg.load_avg, cfs_rq_load_avg(cfs_rq) + 1);