Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH v4] proc: Fix a dentry lock race between release_task and
 lookup
From:   Zhihao Cheng <chengzhihao1@huawei.com>
To:     <ebiederm@xmission.com>
CC:     <linux-kernel@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>,
        <yukuai3@huawei.com>, Matthew Wilcox <willy@infradead.org>,
        <bhe@redhat.com>, <bfoster@redhat.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        <kaleshsingh@google.com>
References: <20220601062332.232439-1-chengzhihao1@huawei.com>
 <6e47d9b8-6b6e-e350-d688-1576f68211ed@huawei.com>
Message-ID: <b7df85db-8e02-8a0f-000f-b36eccf4505e@huawei.com>
Date:   Tue, 12 Jul 2022 11:06:16 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.5.0
MIME-Version: 1.0
In-Reply-To: <6e47d9b8-6b6e-e350-d688-1576f68211ed@huawei.com>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

在 2022/6/10 16:09, Zhihao Cheng 写道:
> 在 2022/6/1 14:23, Zhihao Cheng 写道:
ping again.
> friendly ping
>> Commit 7bc3e6e55acf06 ("proc: Use a list of inodes to flush from proc")
>> moved proc_flush_task() behind __exit_signal(). Then, process systemd
>> can take long period high cpu usage during releasing task in following
>> concurrent processes:
>>
>>    systemd                                 ps
>> kernel_waitid                 stat(/proc/tgid)
>>    do_wait                       filename_lookup
>>      wait_consider_task            lookup_fast
>>        release_task
>>          __exit_signal
>>            __unhash_process
>>              detach_pid
>>                __change_pid // remove task->pid_links
>>                                       d_revalidate -> pid_revalidate  
>> // 0
>>                                       d_invalidate(/proc/tgid)
>>                                         shrink_dcache_parent(/proc/tgid)
>>                                           d_walk(/proc/tgid)
>>                                             
>> spin_lock_nested(/proc/tgid/fd)
>>                                             // iterating opened fd
>>          proc_flush_pid                                    |
>>             d_invalidate (/proc/tgid/fd)                   |
>>                shrink_dcache_parent(/proc/tgid/fd)         |
>>                  shrink_dentry_list(subdirs)               ↓
>>                    shrink_lock_dentry(/proc/tgid/fd) --> race on 
>> dentry lock
>>
>> Function d_invalidate() will remove dentry from hash firstly, but why 
>> does
>> proc_flush_pid() process dentry '/proc/tgid/fd' before dentry 
>> '/proc/tgid'?
>> That's because proc_pid_make_inode() adds proc inode in reverse order by
>> invoking hlist_add_head_rcu(). But proc should not add any inodes under
>> '/proc/tgid' except '/proc/tgid/task/pid', fix it by adding inode into
>> 'pid->inodes' only if the inode is /proc/tgid or /proc/tgid/task/pid.
>>
>> Performance regression:
>> Create 200 tasks, each task open one file for 50,000 times. Kill all
>> tasks when opened files exceed 10,000,000 (cat /proc/sys/fs/file-nr).
>>
> 
> .