Frederic Weisbecker
ad07b60837
workqueue: Fix unbind_workers() VS wq_worker_running() race ...
commit 07edfece8bcb0580a1828d939e6f8d91a8603eb2 upstream.
At CPU-hotplug time, unbind_worker() may preempt a worker while it is
waking up. In that case the following scenario can happen:
unbind_workers() wq_worker_running()
-------------- -------------------
if (!(worker->flags & WORKER_NOT_RUNNING))
//PREEMPTED by unbind_workers
worker->flags |= WORKER_UNBOUND;
[...]
atomic_set(&pool->nr_running, 0);
//resume to worker
atomic_inc(&worker->pool->nr_running);
After unbind_worker() resets pool->nr_running, the value is expected to
remain 0 until the pool ever gets rebound in case cpu_up() is called on
the target CPU in the future. But here the race leaves pool->nr_running
with a value of 1, triggering the following warning when the worker goes
idle:
WARNING: CPU: 3 PID: 34 at kernel/workqueue.c:1823 worker_enter_idle+0x95/0xc0
Modules linked in:
CPU: 3 PID: 34 Comm: kworker/3:0 Not tainted 5.16.0-rc1+ #34
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014
Workqueue: 0x0 (rcu_par_gp)
RIP: 0010:worker_enter_idle+0x95/0xc0
Code: 04 85 f8 ff ff ff 39 c1 7f 09 48 8b 43 50 48 85 c0 74 1b 83 e2 04 75 99 8b 43 34 39 43 30 75 91 8b 83 00 03 00 00 85 c0 74 87 <0f> 0b 5b c3 48 8b 35 70 f1 37 01 48 8d 7b 48 48 81 c6 e0 93 0
RSP: 0000:ffff9b7680277ed0 EFLAGS: 00010086
RAX: 00000000ffffffff RBX: ffff93465eae9c00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff9346418a0000 RDI: ffff934641057140
RBP: ffff934641057170 R08: 0000000000000001 R09: ffff9346418a0080
R10: ffff9b768027fdf0 R11: 0000000000002400 R12: ffff93465eae9c20
R13: ffff93465eae9c20 R14: ffff93465eae9c70 R15: ffff934641057140
FS: 0000000000000000(0000) GS:ffff93465eac0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000001cc0c000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
worker_thread+0x89/0x3d0
? process_one_work+0x400/0x400
kthread+0x162/0x190
? set_kthread_struct+0x40/0x40
ret_from_fork+0x22/0x30
</TASK>
Also due to this incorrect "nr_running == 1", further queued work may
end up not being served, because no worker is awaken at work insert time.
This raises rcutorture writer stalls for example.
Fix this with disabling preemption in the right place in
wq_worker_running().
It's worth noting that if the worker migrates and runs concurrently with
unbind_workers(), it is guaranteed to see the WORKER_UNBOUND flag update
due to set_cpus_allowed_ptr() acquiring/releasing rq->lock.
Fixes: 6d25be5782
2022-01-16 09:15:38 +01:00
bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
2021-12-17 10:12:24 +01:00
cgroup: Make rebind_subsystems() disable v2 controllers all at once
2021-11-17 09:48:34 +01:00
kdb: Make memory allocations more robust
2021-03-04 10:26:10 +01:00
dma-debug: fix sg checks in debug_dma_map_sg()
2021-10-27 09:54:25 +02:00
perf/core: Avoid put_page() when GUP fails
2021-11-26 10:47:22 +01:00
gcov: re-fix clang-11+ support
2021-04-14 08:24:10 +02:00
genirq/timings: Fix error return code in irq_timings_test_irqs()
2021-09-15 09:47:29 +02:00
livepatch: Nullify obj->mod in klp_module_coming()'s error path
2019-08-19 13:03:37 +02:00
locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-17 09:48:28 +01:00
PM: hibernate: use correct mode for swsusp_close()
2021-12-01 09:23:33 +01:00
printk/console: Allow to disable console output by using console="" or console=null
2021-11-12 14:43:03 +01:00
rcu: Mark accesses to rcu_state.n_force_qs
2021-12-22 09:29:40 +01:00
wait: add wake_up_pollfree()
2021-12-14 14:49:02 +01:00
timekeeping: Really make sure wall_to_monotonic isn't positive
2021-12-22 09:29:39 +01:00
tracing: Tag trace_percpu_buffer as a percpu pointer
2022-01-11 15:23:31 +01:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
acct_on(): don't mess with freeze protection
2019-04-04 21:04:13 -04:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441
2019-06-05 17:37:17 +02:00
audit: improve robustness of the audit queue handling
2021-12-22 09:29:35 +01:00
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157
2019-05-30 11:26:37 -07:00
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
2021-09-03 10:08:16 +02:00
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
2020-10-01 13:17:32 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
audit: fix possible null-pointer dereference in audit_filter_rules
2021-10-27 09:54:27 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441
2019-06-05 17:37:17 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
kernel/configs: Replace GPL boilerplate code with SPDX identifier
2019-07-30 18:34:15 +02:00
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
cpu/hotplug: Cure the cpusets trainwreck
2021-07-19 08:53:15 +02:00
kernel/cpu_pm: Fix uninitted local in cpu_pm
2020-06-22 09:31:22 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
keys: Fix request_key() cache
2020-01-17 19:48:42 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 25
2019-05-21 11:52:39 +02:00
don't dump the threads that had been already exiting when zapped.
2020-11-18 19:20:31 +01:00
extable: Add function to search only kernel exception table
2019-08-21 22:23:48 +10:00
fail_function: Remove a redundant mutex unlock
2020-11-24 13:29:18 +01:00
mm/hugetlb: initialize hugetlb_usage in mm_init
2021-09-22 12:26:37 +02:00
Revert "libata, freezer: avoid block device removal while system is frozen"
2019-10-06 09:11:37 -06:00
mm, futex: fix shared futex pgoff on shmem huge page
2021-06-30 08:47:55 -04:00
kbuild: add variables for compression tools
2020-09-03 11:27:10 +02:00
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
mm/nvdimm: add is_ioremap_addr and use that to check ioremap address
2019-07-12 11:05:40 -07:00
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
jump_label: Don't warn on __exit jump entries
2019-08-29 15:10:10 +01:00
kallsyms: Refactor kallsyms_show_value() to take cred
2020-07-16 08:16:44 +02:00
exec: Transform exec_update_mutex into a rw_semaphore
2021-01-09 13:44:55 +01:00
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
sched/rt, Kconfig: Unbreak def/oldconfig with CONFIG_PREEMPT=y
2019-07-22 18:05:11 +02:00
kexec_load: Disable at runtime if the kernel is locked down
2019-08-19 21:54:15 -07:00
kernel: kexec: remove the lock operation of system_transition_mutex
2021-02-03 23:25:56 +01:00
kexec_elf: support 32 bit ELF files
2019-09-06 23:58:44 +02:00
kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
2021-05-19 10:08:28 +02:00
kheaders: Move from proc to sysfs
2019-05-24 20:16:01 +02:00
kmod: make request_module() return an error when autoloading is disabled
2020-04-17 10:50:22 +02:00
kprobes: Limit max data_size of the kretprobe instances
2021-12-08 09:01:10 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 170
2019-05-30 11:26:39 -07:00
kthread: Fix PF_KTHREAD vs to_kthread() race
2021-09-12 08:56:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441
2019-06-05 17:37:17 +02:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36
2019-05-24 17:27:11 +02:00
module: limit enabling module.sig_enforce
2021-06-30 08:47:42 -04:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
2020-10-01 13:17:23 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441
2019-06-05 17:37:17 +02:00
padata: add separate cpuhp node for CPUHP_PADATA_DEAD
2020-06-17 16:40:22 +02:00
panic: ensure preemption is disabled during panic()
2019-10-07 15:47:19 -07:00
lockdown: Lock down module params that specify hardware parameters (eg. ioport)
2019-08-19 21:54:16 -07:00
kernel/pid.c: convert struct pid count to refcount_t
2019-07-16 19:23:24 -07:00
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 12:26:37 +02:00
profiling: fix shift-out-of-bounds bugs
2021-09-26 14:07:09 +02:00
ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
2021-05-26 12:05:15 +02:00
reboot: fix overflow parsing reboot cpu number
2020-11-18 19:20:30 +01:00
kernel/relay.c: fix memleak on destroy relay channel
2020-08-26 10:40:51 +02:00
/dev/mem: Revoke mappings when a driver claims the region
2020-06-24 17:50:35 +02:00
signal: Remove task parameter from force_sig
2019-05-27 09:36:28 -05:00
seccomp: Add missing return in non-void function
2021-03-04 10:26:45 +01:00
signal: Remove the bogus sigkill_pending in ptrace_stop
2021-11-17 09:48:24 +01:00
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
kthread: Extract KTHREAD_IS_PER_CPU
2021-02-07 15:35:49 +01:00
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-07-08 11:01:13 -07:00
stacktrace: Don't skip first entry on noncurrent tasks
2019-11-04 21:19:25 +01:00
stop_machine: Avoid potential race behaviour
2019-10-17 12:47:12 +02:00
prctl: allow to setup brk for et_dyn executables
2021-09-26 14:07:08 +02:00
arch: handle arches who do not yet define clone3
2019-06-21 01:54:53 +02:00
kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
2020-10-01 13:17:10 +02:00
sysctl.c: fix underflow value setting risk in vm_table
2021-03-17 17:03:45 +01:00
taskstats: fix data-race
2020-01-09 10:19:54 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 25
2019-05-21 11:52:39 +02:00
torture: Remove exporting of internal functions
2019-08-01 14:30:22 -07:00
tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2021-07-14 16:53:08 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157
2019-05-30 11:26:37 -07:00
proc/sysctl: add shared variables for range check
2019-07-18 17:08:07 -07:00
usermodehelper: reset umask to default before executing user process
2020-10-14 10:32:58 +02:00
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
Keyrings namespacing
2019-07-08 19:36:47 -07:00
Keyrings namespacing
2019-07-08 19:36:47 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441
2019-06-05 17:37:17 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441
2019-06-05 17:37:17 +02:00
watchdog/softlockup: Enforce that timestamp is valid on boot
2020-02-24 08:36:52 +01:00
kernel/watchdog_hld.c: hard lockup message should end with a newline
2019-04-19 09:46:05 -07:00
workqueue: Fix unbind_workers() VS wq_worker_running() race
2022-01-16 09:15:38 +01:00
sched/core, workqueues: Distangle worker accounting from rq lock
2019-04-16 16:55:15 +02:00
ad07b60837