From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6520C433E3 for ; Mon, 3 Aug 2020 12:34:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A772A2054F for ; Mon, 3 Aug 2020 12:34:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1596458065; bh=RZr674kgVjcvIfO8c39ii+VFyK/OhKBGdmMXsLQk8Ds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OFgZ859fjs/736HZgyAG4Hf6XdNv+xjO0bmz3rdZR44hUyHsYBO31Wp3oPMyPtOZW WG/XWqtW5T+dFX38KC4P3ikFfahKWGUPnTwDt40q5cbeaZbCbPHm/LMSxdw73/2COi kbUKqQGLgCtmlvpfPPZG9IBVyL0Q0J15A0xY2fp4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729550AbgHCMeY (ORCPT ); Mon, 3 Aug 2020 08:34:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:34514 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729545AbgHCMeX (ORCPT ); Mon, 3 Aug 2020 08:34:23 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C1ACB2076B; Mon, 3 Aug 2020 12:34:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1596458062; bh=RZr674kgVjcvIfO8c39ii+VFyK/OhKBGdmMXsLQk8Ds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XhAFFkzRJZNrBF8x0zNxTGQyj7zMaSE3RM096O+4q2SNfaY5DOmWKdd0pIJU8fH3j wo9L5iL1DKv3yAPnCqrksIWPFol+9RbblLi+TLOSrVIRESgDRfgsSfK9wh6sy4k2d8 XbTKIJSBE2hKkA0eC9O9pc99YT4KDgEy1/nUZ3s0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chris Mason , Rik van Riel , Dave Chinner , "Darrick J. Wong" , Samuel Mendoza-Jonas , Frank van der Linden , Suraj Jitindar Singh , Benjamin Herrenschmidt , Anchal Agarwal Subject: [PATCH 4.14 25/51] xfs: fix missed wakeup on l_flush_wait Date: Mon, 3 Aug 2020 14:20:10 +0200 Message-Id: <20200803121850.744837063@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200803121849.488233135@linuxfoundation.org> References: <20200803121849.488233135@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Rik van Riel commit cdea5459ce263fbc963657a7736762ae897a8ae6 upstream. The code in xlog_wait uses the spinlock to make adding the task to the wait queue, and setting the task state to UNINTERRUPTIBLE atomic with respect to the waker. Doing the wakeup after releasing the spinlock opens up the following race condition: Task 1 task 2 add task to wait queue wake up task set task state to UNINTERRUPTIBLE This issue was found through code inspection as a result of kworkers being observed stuck in UNINTERRUPTIBLE state with an empty wait queue. It is rare and largely unreproducable. Simply moving the spin_unlock to after the wake_up_all results in the waker not being able to see a task on the waitqueue before it has set its state to UNINTERRUPTIBLE. This bug dates back to the conversion of this code to generic waitqueue infrastructure from a counting semaphore back in 2008 which didn't place the wakeups consistently w.r.t. to the relevant spin locks. [dchinner: Also fix a similar issue in the shutdown path on xc_commit_wait. Update commit log with more details of the issue.] Fixes: d748c62367eb ("[XFS] Convert l_flushsema to a sv_t") Reported-by: Chris Mason Signed-off-by: Rik van Riel Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Cc: stable@vger.kernel.org # 4.9.x-4.19.x [modified for contextual change near xlog_state_do_callback()] Signed-off-by: Samuel Mendoza-Jonas Reviewed-by: Frank van der Linden Reviewed-by: Suraj Jitindar Singh Reviewed-by: Benjamin Herrenschmidt Reviewed-by: Anchal Agarwal Signed-off-by: Greg Kroah-Hartman --- fs/xfs/xfs_log.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -2684,7 +2684,6 @@ xlog_state_do_callback( int funcdidcallbacks; /* flag: function did callbacks */ int repeats; /* for issuing console warnings if * looping too many times */ - int wake = 0; spin_lock(&log->l_icloglock); first_iclog = iclog = log->l_iclog; @@ -2886,11 +2885,9 @@ xlog_state_do_callback( #endif if (log->l_iclog->ic_state & (XLOG_STATE_ACTIVE|XLOG_STATE_IOERROR)) - wake = 1; - spin_unlock(&log->l_icloglock); - - if (wake) wake_up_all(&log->l_flush_wait); + + spin_unlock(&log->l_icloglock); } @@ -4052,7 +4049,9 @@ xfs_log_force_umount( * item committed callback functions will do this again under lock to * avoid races. */ + spin_lock(&log->l_cilp->xc_push_lock); wake_up_all(&log->l_cilp->xc_commit_wait); + spin_unlock(&log->l_cilp->xc_push_lock); xlog_state_do_callback(log, XFS_LI_ABORTED, NULL); #ifdef XFSERRORDEBUG