* [PATCH] sched: Fix race between yield_to() and try_to_wake_up()
@ 2024-12-31 5:50 Tianchen Ding
2024-12-31 5:56 ` Tianchen Ding
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Tianchen Ding @ 2024-12-31 5:50 UTC (permalink / raw)
To: linux-kernel
Cc: Ingo Molnar, Peter Zijlstra, Juri Lelli, Vincent Guittot,
Dietmar Eggemann, Steven Rostedt, Ben Segall, Mel Gorman,
Valentin Schneider, Marcelo Tosatti, Mike Galbraith, Rik van Riel
We met a SCHED_WARN in set_next_buddy():
__warn_printk
set_next_buddy
yield_to_task_fair
yield_to
kvm_vcpu_yield_to [kvm]
...
After a short dig, we found the rq_lock held by yield_to() may not
be exactly the rq that the target task belongs to. There is a race
window against try_to_wake_up().
CPU0 target_task
blocking on CPU1
lock rq0 & rq1
double check task_rq == p_rq, ok
woken to CPU2 (lock task_pi & rq2)
task_rq = rq2
yield_to_task_fair (w/o lock rq2)
In this race window, yield_to() is operating the task w/o the currect
lock. Fix this by taking task pi_lock first.
Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality")
Signed-off-by: Tianchen Ding <dtcccc@linux.alibaba.com>
---
kernel/sched/syscalls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/syscalls.c b/kernel/sched/syscalls.c
index ff0e5ab4e37c..943406c4ee86 100644
--- a/kernel/sched/syscalls.c
+++ b/kernel/sched/syscalls.c
@@ -1433,7 +1433,7 @@ int __sched yield_to(struct task_struct *p, bool preempt)
struct rq *rq, *p_rq;
int yielded = 0;
- scoped_guard (irqsave) {
+ scoped_guard (raw_spinlock_irqsave, &p->pi_lock) {
rq = this_rq();
again:
--
2.39.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] sched: Fix race between yield_to() and try_to_wake_up()
2024-12-31 5:50 [PATCH] sched: Fix race between yield_to() and try_to_wake_up() Tianchen Ding
@ 2024-12-31 5:56 ` Tianchen Ding
2025-01-06 11:10 ` Peter Zijlstra
2025-01-15 9:17 ` [tip: sched/core] " tip-bot2 for Tianchen Ding
2 siblings, 0 replies; 4+ messages in thread
From: Tianchen Ding @ 2024-12-31 5:56 UTC (permalink / raw)
To: linux-kernel
Cc: Ingo Molnar, Peter Zijlstra, Juri Lelli, Vincent Guittot,
Dietmar Eggemann, Steven Rostedt, Ben Segall, Mel Gorman,
Valentin Schneider, Marcelo Tosatti, Mike Galbraith, Rik van Riel
On 2024/12/31 13:50, Tianchen Ding wrote:
> We met a SCHED_WARN in set_next_buddy():
> __warn_printk
> set_next_buddy
> yield_to_task_fair
> yield_to
> kvm_vcpu_yield_to [kvm]
> ...
>
> After a short dig, we found the rq_lock held by yield_to() may not
> be exactly the rq that the target task belongs to. There is a race
> window against try_to_wake_up().
>
> CPU0 target_task
>
> blocking on CPU1
> lock rq0 & rq1
> double check task_rq == p_rq, ok
> woken to CPU2 (lock task_pi & rq2)
> task_rq = rq2
> yield_to_task_fair (w/o lock rq2)
>
> In this race window, yield_to() is operating the task w/o the currect
Sorry... a typo for "correct"
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] sched: Fix race between yield_to() and try_to_wake_up()
2024-12-31 5:50 [PATCH] sched: Fix race between yield_to() and try_to_wake_up() Tianchen Ding
2024-12-31 5:56 ` Tianchen Ding
@ 2025-01-06 11:10 ` Peter Zijlstra
2025-01-15 9:17 ` [tip: sched/core] " tip-bot2 for Tianchen Ding
2 siblings, 0 replies; 4+ messages in thread
From: Peter Zijlstra @ 2025-01-06 11:10 UTC (permalink / raw)
To: Tianchen Ding
Cc: linux-kernel, Ingo Molnar, Juri Lelli, Vincent Guittot,
Dietmar Eggemann, Steven Rostedt, Ben Segall, Mel Gorman,
Valentin Schneider, Marcelo Tosatti, Mike Galbraith, Rik van Riel
On Tue, Dec 31, 2024 at 01:50:20PM +0800, Tianchen Ding wrote:
> We met a SCHED_WARN in set_next_buddy():
> __warn_printk
> set_next_buddy
> yield_to_task_fair
> yield_to
> kvm_vcpu_yield_to [kvm]
> ...
>
> After a short dig, we found the rq_lock held by yield_to() may not
> be exactly the rq that the target task belongs to. There is a race
> window against try_to_wake_up().
>
> CPU0 target_task
>
> blocking on CPU1
> lock rq0 & rq1
> double check task_rq == p_rq, ok
> woken to CPU2 (lock task_pi & rq2)
> task_rq = rq2
> yield_to_task_fair (w/o lock rq2)
>
> In this race window, yield_to() is operating the task w/o the currect
> lock. Fix this by taking task pi_lock first.
>
> Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality")
> Signed-off-by: Tianchen Ding <dtcccc@linux.alibaba.com>
> ---
> kernel/sched/syscalls.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/sched/syscalls.c b/kernel/sched/syscalls.c
> index ff0e5ab4e37c..943406c4ee86 100644
> --- a/kernel/sched/syscalls.c
> +++ b/kernel/sched/syscalls.c
> @@ -1433,7 +1433,7 @@ int __sched yield_to(struct task_struct *p, bool preempt)
> struct rq *rq, *p_rq;
> int yielded = 0;
>
> - scoped_guard (irqsave) {
> + scoped_guard (raw_spinlock_irqsave, &p->pi_lock) {
> rq = this_rq();
Thanks!
^ permalink raw reply [flat|nested] 4+ messages in thread* [tip: sched/core] sched: Fix race between yield_to() and try_to_wake_up()
2024-12-31 5:50 [PATCH] sched: Fix race between yield_to() and try_to_wake_up() Tianchen Ding
2024-12-31 5:56 ` Tianchen Ding
2025-01-06 11:10 ` Peter Zijlstra
@ 2025-01-15 9:17 ` tip-bot2 for Tianchen Ding
2 siblings, 0 replies; 4+ messages in thread
From: tip-bot2 for Tianchen Ding @ 2025-01-15 9:17 UTC (permalink / raw)
To: linux-tip-commits
Cc: Tianchen Ding, Peter Zijlstra (Intel), x86, linux-kernel
The following commit has been merged into the sched/core branch of tip:
Commit-ID: 5d808c78d97251af1d3a3e4f253e7d6c39fd871e
Gitweb: https://git.kernel.org/tip/5d808c78d97251af1d3a3e4f253e7d6c39fd871e
Author: Tianchen Ding <dtcccc@linux.alibaba.com>
AuthorDate: Tue, 31 Dec 2024 13:50:20 +08:00
Committer: Peter Zijlstra <peterz@infradead.org>
CommitterDate: Mon, 13 Jan 2025 14:10:22 +01:00
sched: Fix race between yield_to() and try_to_wake_up()
We met a SCHED_WARN in set_next_buddy():
__warn_printk
set_next_buddy
yield_to_task_fair
yield_to
kvm_vcpu_yield_to [kvm]
...
After a short dig, we found the rq_lock held by yield_to() may not
be exactly the rq that the target task belongs to. There is a race
window against try_to_wake_up().
CPU0 target_task
blocking on CPU1
lock rq0 & rq1
double check task_rq == p_rq, ok
woken to CPU2 (lock task_pi & rq2)
task_rq = rq2
yield_to_task_fair (w/o lock rq2)
In this race window, yield_to() is operating the task w/o the correct
lock. Fix this by taking task pi_lock first.
Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality")
Signed-off-by: Tianchen Ding <dtcccc@linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20241231055020.6521-1-dtcccc@linux.alibaba.com
---
kernel/sched/syscalls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/syscalls.c b/kernel/sched/syscalls.c
index ff0e5ab..943406c 100644
--- a/kernel/sched/syscalls.c
+++ b/kernel/sched/syscalls.c
@@ -1433,7 +1433,7 @@ int __sched yield_to(struct task_struct *p, bool preempt)
struct rq *rq, *p_rq;
int yielded = 0;
- scoped_guard (irqsave) {
+ scoped_guard (raw_spinlock_irqsave, &p->pi_lock) {
rq = this_rq();
again:
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-01-15 9:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-31 5:50 [PATCH] sched: Fix race between yield_to() and try_to_wake_up() Tianchen Ding
2024-12-31 5:56 ` Tianchen Ding
2025-01-06 11:10 ` Peter Zijlstra
2025-01-15 9:17 ` [tip: sched/core] " tip-bot2 for Tianchen Ding
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox