Received-SPF: pass (google.com: domain of linux-kernel+bounces-204401-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: Yang Yang <yang.yang@vivo.com>
To: Andrew Morton <akpm@linux-foundation.org>,
	Jens Axboe <axboe@kernel.dk>,
	Yang Yang <yang.yang@vivo.com>,
	Pavel Begunkov <asml.silence@gmail.com>,
	linux-kernel@vger.kernel.org,
	linux-block@vger.kernel.org
Subject: [PATCH v3] sbitmap: fix io hung due to race on sbitmap_word::cleared
Date: Thu,  6 Jun 2024 21:57:21 +0800
Message-Id: <20240606135723.2794-1-yang.yang@vivo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?7oah+vxL7ZDcvWDmaIqa0aFHXOmF/4cC0IgpXD0JGMeZpukelXqVeNFUTWIs?=
 =?us-ascii?Q?SjFdwWwRFRXIZzCWYjverIF+MCYt1nrA/LKof/Duu/Ct3iWrb5VI11SqyyYo?=
 =?us-ascii?Q?AnT8gbMKZxLcRgViBNHzGJ8DQAVXTycFIaPJDfwIyYXBV5BCkfy6rOOIhx+A?=
 =?us-ascii?Q?jk9gt5yg5d3apeR1Q/eHvXT6JiExVk67M49XgzFaJt6xl7YX8wGjKXgFJaNa?=
 =?us-ascii?Q?Qx3mdMp5GMHwnlVbWHFEEaMyvA3aEjfVJrP9xwg5ww4n5bRYUazNZ+f9Uvs2?=
 =?us-ascii?Q?4gmb9xionAFRg/OCkA0d9f7crc94lGHF55NZi9TL/LBIPwr6g8hdC4dykFdd?=
 =?us-ascii?Q?09Ewj4tjZVusjM/xkFUkdTEJ8rPLiQBQBsaG0ee50oZMCaFiZApfF57GfzXx?=
 =?us-ascii?Q?471MYOR9axmesJVqu2W0/OjReHmO/kUYByLH/4QKANbYFZ/qhbgbU/rqgnJN?=
 =?us-ascii?Q?mYVTZ2oCzpwU0BHDcw3mkg+b+I8rGIS97nLnvo1IvNwfdphYZ5RB+1iX/6Fd?=
 =?us-ascii?Q?jo1n9tH5V28KMOtVaPKFqew7f0zPYCMtlaI6ySXopbfdXCpPpWsBO3z19aRN?=
 =?us-ascii?Q?kwzEjr9GRfbQlLFRaSzKOBCbMY6BqAN/pkFiFYT0Tnxq6t8Ifa/1xoLhSDdF?=
 =?us-ascii?Q?HgYYbXLxxlMuBrGqWcBSw2g0ZB7dpmHfW7igtkLlhdIzWSe0OaL39JQbvtQs?=
 =?us-ascii?Q?GVhLXiU3LInahprEF2q/ddLaxJO59j+PhbZsOgGvDtKjvay+6WVMtsKod8ZU?=
 =?us-ascii?Q?TwAy6M2wQG0VRrYIzxr7EVCthpBbjpcpCaxVozNnjgmCJFGZ6AjcFjarJDvZ?=
 =?us-ascii?Q?dL3FMBLU5nKfxz93Y3GccHhIbmFn3k/IWKYu4l1zxzxTlRTQ0yFJl08/aMTL?=
 =?us-ascii?Q?4BQ+7CNKARCBCnUWJpy6muF9oPlPnSouwgxrDVfIP87ZZ6IPujJvaYAZjb2+?=
 =?us-ascii?Q?YGywzKb1G//WYp+uX5Z7VOb5vb1y058CEqh1WZ16zwl3Yf8ghO3BQjLZiO3L?=
 =?us-ascii?Q?cPIRAhc61vD6yE9Hcj4zHDqlJKT/PTREMYcpNIUb6jYvkqcr3wtHQ94Ujhg7?=
 =?us-ascii?Q?eKs/9PxiAn1faB+AVo5G62pvDqPHf0GgZduYIkbS14idgCigYRhQtvPFrY30?=
 =?us-ascii?Q?34Rapo1kdQ+Nontka4ogRInVdfsDJV0PvhBPeKiJKNOHhELFyaDi5iUK6ERO?=
 =?us-ascii?Q?THFofm+OM/7TB5AkTpNQUVYeX+FvQXSi7zQHSSqZpHn9zA0kIVWdR4NfIODd?=
 =?us-ascii?Q?xwIlKbN8b2WUoK8mt6ghnRV8xKbKGhzqDvnoHLw1Y6hOI8NpUvcL59ZwOlim?=
 =?us-ascii?Q?LlaaFqwqPokipj3F7iNU8+MLNHvlCPYcqH2TB48dC1QlY1vSeFMq6oQgEury?=
 =?us-ascii?Q?qOzAzNjrjROq9LnrhZPmQkt+tJCH6MCdpQmkRCMCtN6t1Ms9HQHtNfu0xyZ7?=
 =?us-ascii?Q?tvg8Gb7tzhILx7fez7z80amLMOHM1MSmdYOa9kq3kITJHVAMSs/flsqKRN4m?=
 =?us-ascii?Q?y1t2IYvHS3bvBqzKlfd4Qo3rvnav+1dJ4b7HO0ndGH2YDyrE2R/KVw/sMwZ7?=
 =?us-ascii?Q?NVfDbPz7Ir4w9txIiw5jgJLUOT0tCDiRioqfKr0i?=
X-OriginatorOrg: vivo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5be3eab0-6368-441f-8947-08dc8630ac04
X-MS-Exchange-CrossTenant-AuthSource: KL1PR06MB7401.apcprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jun 2024 13:57:58.3758
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 923e42dc-48d5-4cbe-b582-1a797a6412ed
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: FAxuGY8HOQMbbG5ChHEsBXRy1u2TKnSyBS94mEjtYJZ+ZyWkOx98/LPnWqU1Db7sYNOvr92mj2Nw50j2ajexww==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: JH0PR06MB6317

Configuration for sbq:
  depth=64, wake_batch=6, shift=6, map_nr=1

1. There are 64 requests in progress:
  map->word = 0xFFFFFFFFFFFFFFFF
2. After all the 64 requests complete, and no more requests come:
  map->word = 0xFFFFFFFFFFFFFFFF, map->cleared = 0xFFFFFFFFFFFFFFFF
3. Now two tasks try to allocate requests:
  T1:                                       T2:
  __blk_mq_get_tag                          .
  __sbitmap_queue_get                       .
  sbitmap_get                               .
  sbitmap_find_bit                          .
  sbitmap_find_bit_in_word                  .
  __sbitmap_get_word  -> nr=-1              __blk_mq_get_tag
  sbitmap_deferred_clear                    __sbitmap_queue_get
  /* map->cleared=0xFFFFFFFFFFFFFFFF */     sbitmap_find_bit
    if (!READ_ONCE(map->cleared))           sbitmap_find_bit_in_word
      return false;                         __sbitmap_get_word -> nr=-1
    mask = xchg(&map->cleared, 0)           sbitmap_deferred_clear
    atomic_long_andnot()                    /* map->cleared=0 */
                                              if (!(map->cleared))
                                                return false;
                                     /*
                                      * map->cleared is cleared by T1
                                      * T2 fail to acquire the tag
                                      */

4. T2 is the sole tag waiter. When T1 puts the tag, T2 cannot be woken
up due to the wake_batch being set at 6. If no more requests come, T1
will wait here indefinitely.

This patch achieves two purposes:
First:
Check on ->cleared and update on both ->cleared and ->word need to be
done atomically, and using spinlock could be the simplest solution.
So revert commit 661d4f55a794 ("sbitmap: remove swap_lock"), which
may cause potential race.

Second:
Add extra check in sbitmap_deferred_clear(), to identify whether
map->cleared is cleared by another task after failing to get a tag.

Fixes: 661d4f55a794 ("sbitmap: remove swap_lock")
Signed-off-by: Yang Yang <yang.yang@vivo.com>

---
Changes from v2:
  - Modify commit message by suggestion
  - Add extra check in sbitmap_deferred_clear() by suggestion
Changes from v1:
  - simply revert commit 661d4f55a794 ("sbitmap: remove swap_lock")
---
 include/linux/sbitmap.h |  5 +++++
 lib/sbitmap.c           | 28 +++++++++++++++++++++-------
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/include/linux/sbitmap.h b/include/linux/sbitmap.h
index d662cf136021..ec0b0e73c906 100644
--- a/include/linux/sbitmap.h
+++ b/include/linux/sbitmap.h
@@ -36,6 +36,11 @@ struct sbitmap_word {
 	 * @cleared: word holding cleared bits
 	 */
 	unsigned long cleared ____cacheline_aligned_in_smp;
+
+	/**
+	 * @swap_lock: Held while swapping word <-> cleared
+	 */
+	spinlock_t swap_lock;
 } ____cacheline_aligned_in_smp;
 
 /**
diff --git a/lib/sbitmap.c b/lib/sbitmap.c
index 1e453f825c05..06b837311e03 100644
--- a/lib/sbitmap.c
+++ b/lib/sbitmap.c
@@ -60,12 +60,19 @@ static inline void update_alloc_hint_after_get(struct sbitmap *sb,
 /*
  * See if we have deferred clears that we can batch move
  */
-static inline bool sbitmap_deferred_clear(struct sbitmap_word *map)
+static inline bool sbitmap_deferred_clear(struct sbitmap_word *map,
+		unsigned int depth)
 {
 	unsigned long mask;
+	unsigned long flags;
+	bool ret;
 
-	if (!READ_ONCE(map->cleared))
-		return false;
+	spin_lock_irqsave(&map->swap_lock, flags);
+
+	if (!map->cleared) {
+		ret = find_first_zero_bit(&map->word, depth) >= depth ? false : true;
+		goto out_unlock;
+	}
 
 	/*
 	 * First get a stable cleared mask, setting the old mask to 0.
@@ -77,7 +84,10 @@ static inline bool sbitmap_deferred_clear(struct sbitmap_word *map)
 	 */
 	atomic_long_andnot(mask, (atomic_long_t *)&map->word);
 	BUILD_BUG_ON(sizeof(atomic_long_t) != sizeof(map->word));
-	return true;
+	ret = true;
+out_unlock:
+	spin_unlock_irqrestore(&map->swap_lock, flags);
+	return ret;
 }
 
 int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift,
@@ -85,6 +95,7 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift,
 		      bool alloc_hint)
 {
 	unsigned int bits_per_word;
+	int i;
 
 	if (shift < 0)
 		shift = sbitmap_calculate_shift(depth);
@@ -116,6 +127,9 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift,
 		return -ENOMEM;
 	}
 
+	for (i = 0; i < sb->map_nr; i++)
+		spin_lock_init(&sb->map[i].swap_lock);
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(sbitmap_init_node);
@@ -126,7 +140,7 @@ void sbitmap_resize(struct sbitmap *sb, unsigned int depth)
 	unsigned int i;
 
 	for (i = 0; i < sb->map_nr; i++)
-		sbitmap_deferred_clear(&sb->map[i]);
+		sbitmap_deferred_clear(&sb->map[i], depth);
 
 	sb->depth = depth;
 	sb->map_nr = DIV_ROUND_UP(sb->depth, bits_per_word);
@@ -179,7 +193,7 @@ static int sbitmap_find_bit_in_word(struct sbitmap_word *map,
 					alloc_hint, wrap);
 		if (nr != -1)
 			break;
-		if (!sbitmap_deferred_clear(map))
+		if (!sbitmap_deferred_clear(map, depth))
 			break;
 	} while (1);
 
@@ -496,7 +510,7 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags,
 		unsigned int map_depth = __map_depth(sb, index);
 		unsigned long val;
 
-		sbitmap_deferred_clear(map);
+		sbitmap_deferred_clear(map, map_depth);
 		val = READ_ONCE(map->word);
 		if (val == (1UL << (map_depth - 1)) - 1)
 			goto next;
-- 
2.34.1