Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Sebastian Andrzej Siewior <bigeasy@linutronix.de>
To:     linux-kernel@vger.kernel.org
Cc:     Ben Segall <bsegall@google.com>, Boqun Feng <boqun.feng@gmail.com>,
        Crystal Wood <swood@redhat.com>,
        Daniel Bristot de Oliveira <bristot@redhat.com>,
        Dietmar Eggemann <dietmar.eggemann@arm.com>,
        Ingo Molnar <mingo@redhat.com>,
        John Stultz <jstultz@google.com>,
        Juri Lelli <juri.lelli@redhat.com>,
        Mel Gorman <mgorman@suse.de>,
        Peter Zijlstra <peterz@infradead.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Valentin Schneider <vschneid@redhat.com>,
        Vincent Guittot <vincent.guittot@linaro.org>,
        Waiman Long <longman@redhat.com>, Will Deacon <will@kernel.org>
Subject: [PATCH v2 0/4] locking/rtmutex: Avoid overwriting pi_blocked_on while invoking blk_flush_plug().
Date:   Thu, 27 Apr 2023 13:19:33 +0200
Message-Id: <20230427111937.2745231-1-bigeasy@linutronix.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi,

Crystal Wood reported that task_struct::pi_blocked_on can be overwritten
by mistake that is:
	rt_mutex_slowlock()
	  - task_blocks_on_rt_mutex()
	    - current->pi_blocked_on =3D waiter;
	  - rt_mutex_slowlock_block()
	    - schedule()=20
	      - sched_submit_work()
	        - blk_flush_plug()
		  - *any* RT sleeping lock used by the plug
		     - rtlock_slowlock_locked()
	               - task_blocks_on_rt_mutex()
		         - current->pi_blocked_on =3D waiter; <-- XXX

The requirement is
- I/O queued
- lock contention on a sleeping lock (a mutex_t)
- lock contention while flushing queued I/O (in blk_flush_plug(), a
  spin_lock_t on PREEMPT_RT).

Later in review it was pointed out by tglx that any function within
sched_submit_work() is affected so it is not limited to
blk_flush_plug().

This series addresses the problem by
- export sched_submit_work()
- invoke sched_submit_work() if it is clear that the slow path is
  needed.
- invoke schedule_rtmutex() while blocking on lock which contains only
  the schedule loop (without sched_submit_work().

Original report by Crystal
	https://lore.kernel.org/all/4b4ab374d3e24e6ea8df5cadc4297619a6d945af.camel=
@redhat.com

v1: https://lore.kernel.org/all/20230322162719.wYG1N0hh@linutronix.de

v1=E2=80=A6v2:
   - Avoid invoking blk_flush_plug() with DEBUG-enabled
   - Fix also the ww-mutex implementation based on RT-mutex.
   - Export sched_submit_work() and do the whole block before blocking
     not just blk_flush_plug().

Sebastian