* [PATCH] kernel: locking: rtmutex: Fix a possible sleep-in-atomic-context bug in rt_mutex_handle_deadlock()
@ 2018-08-11 2:35 Jia-Ju Bai
2018-08-11 2:44 ` Steven Rostedt
0 siblings, 1 reply; 3+ messages in thread
From: Jia-Ju Bai @ 2018-08-11 2:35 UTC (permalink / raw)
To: peterz, mingo, will.deacon; +Cc: linux-kernel, Jia-Ju Bai
The driver may sleep with holding a spinlock.
The function call paths (from bottom to top) in Linux-4.16 are:
[FUNC] schedule
kernel/locking/rtmutex.c, 1223:
schedule in rt_mutex_handle_deadlock
kernel/locking/rtmutex.c, 1273:
rt_mutex_handle_deadlock in rt_mutex_slowlock
kernel/locking/rtmutex.c, 1249:
_raw_spin_lock_irqsave in rt_mutex_slowlock
To fix the bug, the spinlock is released before schedule() and then acquired again.
This is found by my static analysis tool (DSAC).
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
kernel/locking/rtmutex.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 2823d4163a37..af03e162f812 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1205,7 +1205,7 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
}
static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
- struct rt_mutex_waiter *w)
+ struct rt_mutex_waiter *w, struct rt_mutex *lock)
{
/*
* If the result is not -EDEADLOCK or the caller requested
@@ -1219,8 +1219,10 @@ static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
*/
rt_mutex_print_deadlock(w);
while (1) {
+ raw_spin_unlock_irq(&lock->wait_lock);
set_current_state(TASK_INTERRUPTIBLE);
schedule();
+ raw_spin_lock_irq(&lock->wait_lock);
}
}
@@ -1269,7 +1271,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
if (unlikely(ret)) {
__set_current_state(TASK_RUNNING);
remove_waiter(lock, &waiter);
- rt_mutex_handle_deadlock(ret, chwalk, &waiter);
+ rt_mutex_handle_deadlock(ret, chwalk, &waiter, lock);
}
/*
--
2.17.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] kernel: locking: rtmutex: Fix a possible sleep-in-atomic-context bug in rt_mutex_handle_deadlock()
2018-08-11 2:35 [PATCH] kernel: locking: rtmutex: Fix a possible sleep-in-atomic-context bug in rt_mutex_handle_deadlock() Jia-Ju Bai
@ 2018-08-11 2:44 ` Steven Rostedt
2018-08-11 2:50 ` Jia-Ju Bai
0 siblings, 1 reply; 3+ messages in thread
From: Steven Rostedt @ 2018-08-11 2:44 UTC (permalink / raw)
To: Jia-Ju Bai; +Cc: peterz, mingo, will.deacon, linux-kernel
On Sat, Aug 11, 2018 at 10:35:24AM +0800, Jia-Ju Bai wrote:
> The driver may sleep with holding a spinlock.
>
> The function call paths (from bottom to top) in Linux-4.16 are:
>
> [FUNC] schedule
> kernel/locking/rtmutex.c, 1223:
> schedule in rt_mutex_handle_deadlock
> kernel/locking/rtmutex.c, 1273:
> rt_mutex_handle_deadlock in rt_mutex_slowlock
> kernel/locking/rtmutex.c, 1249:
> _raw_spin_lock_irqsave in rt_mutex_slowlock
>
> To fix the bug, the spinlock is released before schedule() and then acquired again.
> This is found by my static analysis tool (DSAC).
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
> ---
> kernel/locking/rtmutex.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
> index 2823d4163a37..af03e162f812 100644
> --- a/kernel/locking/rtmutex.c
> +++ b/kernel/locking/rtmutex.c
> @@ -1205,7 +1205,7 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
> }
>
> static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
> - struct rt_mutex_waiter *w)
> + struct rt_mutex_waiter *w, struct rt_mutex *lock)
> {
> /*
> * If the result is not -EDEADLOCK or the caller requested
> @@ -1219,8 +1219,10 @@ static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
> */
> rt_mutex_print_deadlock(w);
> while (1) {
> + raw_spin_unlock_irq(&lock->wait_lock);
> set_current_state(TASK_INTERRUPTIBLE);
> schedule();
> + raw_spin_lock_irq(&lock->wait_lock);
> }
If you look at the code you will notice that it stops the task and never lets
it continue. Ever.
If we hit this path, it means we are in a deadlock scenario and will not make
any forward progress.
If anything, it should simply be:
rt_mutex_print_deadlock(w);
+ /* We're not going anywhere, release the wait_lock */
+ raw_spin_unlock_irq(&lock->wait_lock);
while (1) {
set_current_state(TASK_INTERRUPTIBLE);
schedule();
}
-- Steve
> }
>
> @@ -1269,7 +1271,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
> if (unlikely(ret)) {
> __set_current_state(TASK_RUNNING);
> remove_waiter(lock, &waiter);
> - rt_mutex_handle_deadlock(ret, chwalk, &waiter);
> + rt_mutex_handle_deadlock(ret, chwalk, &waiter, lock);
> }
>
> /*
> --
> 2.17.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] kernel: locking: rtmutex: Fix a possible sleep-in-atomic-context bug in rt_mutex_handle_deadlock()
2018-08-11 2:44 ` Steven Rostedt
@ 2018-08-11 2:50 ` Jia-Ju Bai
0 siblings, 0 replies; 3+ messages in thread
From: Jia-Ju Bai @ 2018-08-11 2:50 UTC (permalink / raw)
To: Steven Rostedt; +Cc: peterz, mingo, will.deacon, linux-kernel
On 2018/8/11 10:44, Steven Rostedt wrote:
> On Sat, Aug 11, 2018 at 10:35:24AM +0800, Jia-Ju Bai wrote:
>> The driver may sleep with holding a spinlock.
>>
>> The function call paths (from bottom to top) in Linux-4.16 are:
>>
>> [FUNC] schedule
>> kernel/locking/rtmutex.c, 1223:
>> schedule in rt_mutex_handle_deadlock
>> kernel/locking/rtmutex.c, 1273:
>> rt_mutex_handle_deadlock in rt_mutex_slowlock
>> kernel/locking/rtmutex.c, 1249:
>> _raw_spin_lock_irqsave in rt_mutex_slowlock
>>
>> To fix the bug, the spinlock is released before schedule() and then acquired again.
>> This is found by my static analysis tool (DSAC).
>>
>> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
>> ---
>> kernel/locking/rtmutex.c | 6 ++++--
>> 1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
>> index 2823d4163a37..af03e162f812 100644
>> --- a/kernel/locking/rtmutex.c
>> +++ b/kernel/locking/rtmutex.c
>> @@ -1205,7 +1205,7 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
>> }
>>
>> static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
>> - struct rt_mutex_waiter *w)
>> + struct rt_mutex_waiter *w, struct rt_mutex *lock)
>> {
>> /*
>> * If the result is not -EDEADLOCK or the caller requested
>> @@ -1219,8 +1219,10 @@ static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
>> */
>> rt_mutex_print_deadlock(w);
>> while (1) {
>> + raw_spin_unlock_irq(&lock->wait_lock);
>> set_current_state(TASK_INTERRUPTIBLE);
>> schedule();
>> + raw_spin_lock_irq(&lock->wait_lock);
>> }
> If you look at the code you will notice that it stops the task and never lets
> it continue. Ever.
>
> If we hit this path, it means we are in a deadlock scenario and will not make
> any forward progress.
>
> If anything, it should simply be:
>
> rt_mutex_print_deadlock(w);
> + /* We're not going anywhere, release the wait_lock */
> + raw_spin_unlock_irq(&lock->wait_lock);
> while (1) {
> set_current_state(TASK_INTERRUPTIBLE);
> schedule();
> }
Thanks for your reply :)
Okay, I will send a V2 patch.
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-08-11 2:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-08-11 2:35 [PATCH] kernel: locking: rtmutex: Fix a possible sleep-in-atomic-context bug in rt_mutex_handle_deadlock() Jia-Ju Bai
2018-08-11 2:44 ` Steven Rostedt
2018-08-11 2:50 ` Jia-Ju Bai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox