Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 28 Jun 2019 12:45:59 -0400
From:   Joel Fernandes <joel@joelfernandes.org>
To:     "Paul E. McKenney" <paulmck@linux.ibm.com>
Cc:     Steven Rostedt <rostedt@goodmis.org>,
        Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
        rcu <rcu@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Josh Triplett <josh@joshtriplett.org>,
        Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
        Lai Jiangshan <jiangshanlai@gmail.com>
Subject: Re: [RFC] Deadlock via recursive wakeup via RCU with threadirqs
Message-ID: <20190628164559.GC240964@google.com>
References: <20190626162558.GY26519@linux.ibm.com>
 <20190627142436.GD215968@google.com>
 <20190627103455.01014276@gandalf.local.home>
 <20190627153031.GA249127@google.com>
 <20190627155506.GU26519@linux.ibm.com>
 <CAEXW_YSEN_OL3ftTLN=M-W70WSuCgHJqU-R9VhS=A3uVj_AL+A@mail.gmail.com>
 <20190627173831.GW26519@linux.ibm.com>
 <20190627181638.GA209455@google.com>
 <20190627184107.GA26519@linux.ibm.com>
 <20190628164008.GB240964@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20190628164008.GB240964@google.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Jun 28, 2019 at 12:40:08PM -0400, Joel Fernandes wrote:
> On Thu, Jun 27, 2019 at 11:41:07AM -0700, Paul E. McKenney wrote:
> [snip]
> > > > > And we should document this somewhere for future sanity preservation
> > > > > :-D
> > > > 
> > > > Or adjust the code and requirements to make it more sane, if feasible.
> > > > 
> > > > My current (probably wildly unreliable) guess that the conditions in
> > > > rcu_read_unlock_special() need adjusting.  I was assuming that in_irq()
> > > > implies a hardirq context, in other words that in_irq() would return
> > > > false from a threaded interrupt handler.  If in_irq() instead returns
> > > > true from within a threaded interrupt handler, then this code in
> > > > rcu_read_unlock_special() needs fixing:
> > > > 
> > > > 		if ((exp || in_irq()) && irqs_were_disabled && use_softirq &&
> > > > 		    (in_irq() || !t->rcu_read_unlock_special.b.deferred_qs)) {
> > > > 			// Using softirq, safe to awaken, and we get
> > > > 			// no help from enabling irqs, unlike bh/preempt.
> > > > 			raise_softirq_irqoff(RCU_SOFTIRQ);
> > > > 
> > > > The fix would be replacing the calls to in_irq() with something that
> > > > returns true only if called from within a hardirq context.
> > > > Thoughts?
> > > 
> > > I am not sure if this will fix all cases though?
> > > 
> > > I think the crux of the problem is doing a recursive wake up. The threaded
> > > IRQ probably just happens to be causing it here, it seems to me this problem
> > > can also occur on a non-threaded irq system (say current_reader() in your
> > > example executed in a scheduler path in process-context and not from an
> > > interrupt). Is that not possible?
> > 
> > In the non-threaded case, invoking raise_softirq*() from hardirq context
> > just sets a bit in a per-CPU variable.  Now, to Sebastian's point, we
> > are only sort of in hardirq context in this case due to being called
> > from irq_exit(), but the failure we are seeing might well be a ways
> > downstream of the actual root-cause bug.
> 
> Hi Paul,
> I was talking about calling of rcu_read_unlock_special from a normal process
> context from the scheduler.
> 
> In the below traces, it shows that only the PREEMPT_MASK offset is set at the
> time of the issue. Both HARD AND SOFT IRQ masks are not enabled, which means
> the lock up is from a normal process context.
> 
> I think I finally understood why the issue shows up only with threadirqs in
> my setup. If I build x86_64_defconfig, the CONFIG_IRQ_FORCED_THREADING=y
> option is set. And booting this with threadirqs, it always tries to
> wakeup_ksoftirqd in invoke_softirq.
> 
> I believe what happens is, at an in-opportune time when the .blocked field is
> set for the preempted task, an interrupt is received. This timing is quite in
> auspicious because t->rcu_read_unlock_special just happens to have its
> .blocked field set even though it is not in a reader-section.

I believe the .blocked field remains set even though we are not any more in a
reader section because of deferred processing of the blocked lists that you
mentioned yesterday.