Received: by 2002:a25:683:0:0:0:0:0 with SMTP id 125csp112367ybg; Mon, 8 Jun 2020 17:57:39 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxPpSGebMTifnxepGi/q0Cvwx8JY1Wgrbj8qNGxKWW8WhEIUUCNZeiVROxpit8pn0KR9P7R X-Received: by 2002:a17:906:3cf:: with SMTP id c15mr22858644eja.186.1591664258933; Mon, 08 Jun 2020 17:57:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591664258; cv=none; d=google.com; s=arc-20160816; b=UOY7CQ1fF/fPPIEOA91NEMC/vVRhKwa7tqyLdDiAKnz64LaHPJPuZf+utXUU9qD4aO WQ5WqP3EfEVViCdeEizYjdfnVSvoUXePA1LzaVhEcORsMP1hFGNqRSKIhk/njBJU+xCj 9lvx0hrLP3li3QoMjFbcpLCleLM+JeohIH1I7EJtWJSiT9o134MSBBbOZoRVvjOR/ksp LwWCP5dZUj1Dg3hsvMIX2O69x9+02GOuJunZ8hZuQhkImaL04Y4JRaRIzF78PyeL5jk9 rBBvRTxraEoiSO/IupYiizdMo+hBnrFxBc2Nvs5OkuNG8bzNioo8N0eUGTO9dUSnLXP+ 2mHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=058aBXb3cQ4PhCnEJKQigPZx0ZLdLwRwxHmfjO3DvdM=; b=Gt0w/Swh57eEddtTlT+x55d+7ZAjGD2WfJJhzUUkTzl3A4WCpG2mUSTSYLNAPLoQNs g0FuNUhxV12CzW8zW6jYk6nzNM05ZVkJYiASURpi3qwArhPv4NOFjsVm2F4Nzg2BX9SE KO4pajXiPXOQq/Y4shBer0nhb4jY0QCNHszx9ejn15W68RjcIMWq19XxohkoVeiA3ywe CP+t/EBpP9a7X4fVUqsEyS/Ol1T66QpcPE5pe9cIRuc559qXJBspuD2ZsIdj5Ko+tpRG vuK+5wVJ1+fKxclZXzRbIzN0V3uQ02p7XFdUTiTLG2Ky7IOf+fWuUnhxE1PIwDkhTMwd ynIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=ScuVlswD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id va29si9745149ejb.235.2020.06.08.17.57.16; Mon, 08 Jun 2020 17:57:38 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=ScuVlswD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728677AbgFIAzb (ORCPT + 99 others); Mon, 8 Jun 2020 20:55:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:55066 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728393AbgFHXJU (ORCPT ); Mon, 8 Jun 2020 19:09:20 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3B3FF208C3; Mon, 8 Jun 2020 23:09:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591657760; bh=x0MXilqjWFoGf1w3AwECfY3U95b1XL8ugjDvAzAarPw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ScuVlswDwbZXNFWxcfqguRUqLjW52cU7lAWYb5/tb6UyPhqf+oUjH2sHjfsAUsXy5 e1X+Uh4x0KUvEH29vKjpWRQ32YlkCj7G/9F+F+4pv0rVQUyW5VUeh81HLhloZDQ6Gj ut7YdfMOgh2cOD/v9yxGvRAQycr45LArQkXF8KCI= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Peter Zijlstra , Qian Cai , Michael Ellerman , Sasha Levin , linuxppc-dev@lists.ozlabs.org Subject: [PATCH AUTOSEL 5.7 145/274] sched/core: Fix illegal RCU from offline CPUs Date: Mon, 8 Jun 2020 19:03:58 -0400 Message-Id: <20200608230607.3361041-145-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200608230607.3361041-1-sashal@kernel.org> References: <20200608230607.3361041-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Peter Zijlstra [ Upstream commit bf2c59fce4074e55d622089b34be3a6bc95484fb ] In the CPU-offline process, it calls mmdrop() after idle entry and the subsequent call to cpuhp_report_idle_dead(). Once execution passes the call to rcu_report_dead(), RCU is ignoring the CPU, which results in lockdep complaining when mmdrop() uses RCU from either memcg or debugobjects below. Fix it by cleaning up the active_mm state from BP instead. Every arch which has CONFIG_HOTPLUG_CPU should have already called idle_task_exit() from AP. The only exception is parisc because it switches them to &init_mm unconditionally (see smp_boot_one_cpu() and smp_cpu_init()), but the patch will still work there because it calls mmgrab(&init_mm) in smp_cpu_init() and then should call mmdrop(&init_mm) in finish_cpu(). WARNING: suspicious RCU usage ----------------------------- kernel/workqueue.c:710 RCU or wq_pool_mutex should be held! other info that might help us debug this: RCU used illegally from offline CPU! Call Trace: dump_stack+0xf4/0x164 (unreliable) lockdep_rcu_suspicious+0x140/0x164 get_work_pool+0x110/0x150 __queue_work+0x1bc/0xca0 queue_work_on+0x114/0x120 css_release+0x9c/0xc0 percpu_ref_put_many+0x204/0x230 free_pcp_prepare+0x264/0x570 free_unref_page+0x38/0xf0 __mmdrop+0x21c/0x2c0 idle_task_exit+0x170/0x1b0 pnv_smp_cpu_kill_self+0x38/0x2e0 cpu_die+0x48/0x64 arch_cpu_idle_dead+0x30/0x50 do_idle+0x2f4/0x470 cpu_startup_entry+0x38/0x40 start_secondary+0x7a8/0xa80 start_secondary_resume+0x10/0x14 Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Qian Cai Signed-off-by: Peter Zijlstra (Intel) Acked-by: Michael Ellerman (powerpc) Link: https://lkml.kernel.org/r/20200401214033.8448-1-cai@lca.pw Signed-off-by: Sasha Levin --- arch/powerpc/platforms/powernv/smp.c | 1 - include/linux/sched/mm.h | 2 ++ kernel/cpu.c | 18 +++++++++++++++++- kernel/sched/core.c | 5 +++-- 4 files changed, 22 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c index 13e251699346..b2ba3e95bda7 100644 --- a/arch/powerpc/platforms/powernv/smp.c +++ b/arch/powerpc/platforms/powernv/smp.c @@ -167,7 +167,6 @@ static void pnv_smp_cpu_kill_self(void) /* Standard hot unplug procedure */ idle_task_exit(); - current->active_mm = NULL; /* for sanity */ cpu = smp_processor_id(); DBG("CPU%d offline\n", cpu); generic_set_cpu_dead(cpu); diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h index c49257a3b510..a132d875d351 100644 --- a/include/linux/sched/mm.h +++ b/include/linux/sched/mm.h @@ -49,6 +49,8 @@ static inline void mmdrop(struct mm_struct *mm) __mmdrop(mm); } +void mmdrop(struct mm_struct *mm); + /* * This has to be called after a get_task_mm()/mmget_not_zero() * followed by taking the mmap_sem for writing before modifying the diff --git a/kernel/cpu.c b/kernel/cpu.c index 2371292f30b0..244d30544377 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -3,6 +3,7 @@ * * This code is licenced under the GPL. */ +#include #include #include #include @@ -564,6 +565,21 @@ static int bringup_cpu(unsigned int cpu) return bringup_wait_for_ap(cpu); } +static int finish_cpu(unsigned int cpu) +{ + struct task_struct *idle = idle_thread_get(cpu); + struct mm_struct *mm = idle->active_mm; + + /* + * idle_task_exit() will have switched to &init_mm, now + * clean up any remaining active_mm state. + */ + if (mm != &init_mm) + idle->active_mm = &init_mm; + mmdrop(mm); + return 0; +} + /* * Hotplug state machine related functions */ @@ -1549,7 +1565,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { [CPUHP_BRINGUP_CPU] = { .name = "cpu:bringup", .startup.single = bringup_cpu, - .teardown.single = NULL, + .teardown.single = finish_cpu, .cant_stop = true, }, /* Final state before CPU kills itself */ diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 9a2fbf98fd6f..0bbf387d0f19 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6190,13 +6190,14 @@ void idle_task_exit(void) struct mm_struct *mm = current->active_mm; BUG_ON(cpu_online(smp_processor_id())); + BUG_ON(current != this_rq()->idle); if (mm != &init_mm) { switch_mm(mm, &init_mm, current); - current->active_mm = &init_mm; finish_arch_post_lock_switch(); } - mmdrop(mm); + + /* finish_cpu(), as ran on the BP, will clean up the active_mm state */ } /* -- 2.25.1