lkml.org 
[lkml]   [2017]   [Oct]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.13 115/160] cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns
    Date
    4.13-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Waiman Long <longman@redhat.com>

    commit c4fa6c43ce4b427350cfbb659436bfe3d9e09a1d upstream.

    The cgroup_taskset structure within the larger cgroup_mgctx structure
    is supposed to be used once and then discarded. That is not really the
    case in the hotplug code path:

    cpuset_hotplug_workfn()
    - cgroup_transfer_tasks()
    - cgroup_migrate()
    - cgroup_migrate_add_task()
    - cgroup_migrate_execute()

    In this case, the cgroup_migrate() function is called multiple time
    with the same cgroup_mgctx structure to transfer the tasks from
    one cgroup to another one-by-one. The second time cgroup_migrate()
    is called, the cgroup_taskset will be in an incorrect state and so
    may cause the system to panic. For example,

    [ 150.888410] Faulting instruction address: 0xc0000000001db648
    [ 150.888414] Oops: Kernel access of bad area, sig: 11 [#1]
    [ 150.888417] SMP NR_CPUS=2048
    [ 150.888417] NUMA
    [ 150.888419] pSeries
    :
    [ 150.888545] NIP [c0000000001db648] cpuset_can_attach+0x58/0x1b0
    [ 150.888548] LR [c0000000001db638] cpuset_can_attach+0x48/0x1b0
    [ 150.888551] Call Trace:
    [ 150.888554] [c0000005f65cb940] [c0000000001db638] cpuset_can_attach+0x48/0x1b 0 (unreliable)
    [ 150.888559] [c0000005f65cb9a0] [c0000000001cff04] cgroup_migrate_execute+0xc4/0x4b0
    [ 150.888563] [c0000005f65cba20] [c0000000001d7d14] cgroup_transfer_tasks+0x1d4/0x370
    [ 150.888568] [c0000005f65cbb70] [c0000000001ddcb0] cpuset_hotplug_workfn+0x710/0x8f0
    [ 150.888572] [c0000005f65cbc80] [c00000000012032c] process_one_work+0x1ac/0x4d0
    [ 150.888576] [c0000005f65cbd20] [c0000000001206f8] worker_thread+0xa8/0x5b0
    [ 150.888580] [c0000005f65cbdc0] [c0000000001293f8] kthread+0x168/0x1b0
    [ 150.888584] [c0000005f65cbe30] [c00000000000b368] ret_from_kernel_thread+0x5c/0x74

    To allow reuse of the cgroup_mgctx structure, some fields in that
    structure are now re-initialized at the end of cgroup_migrate_execute()
    function call so that the structure can be reused again in a later
    iteration without causing problem.

    This bug was introduced in the commit e595cd706982 ("group: track
    migration context in cgroup_mgctx") in 4.11. This commit moves the
    cgroup_taskset initialization out of cgroup_migrate(). The commit
    10467270fb3 ("cgroup: don't call migration methods if there are no
    tasks to migrate") helped, but did not completely resolve the problem.

    Fixes: e595cd706982bff0211e6fafe5a108421e747fbc ("group: track migration context in cgroup_mgctx")
    Signed-off-by: Waiman Long <longman@redhat.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/cgroup/cgroup.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    --- a/kernel/cgroup/cgroup.c
    +++ b/kernel/cgroup/cgroup.c
    @@ -2168,6 +2168,14 @@ out_release_tset:
    list_del_init(&cset->mg_node);
    }
    spin_unlock_irq(&css_set_lock);
    +
    + /*
    + * Re-initialize the cgroup_taskset structure in case it is reused
    + * again in another cgroup_migrate_add_task()/cgroup_migrate_execute()
    + * iteration.
    + */
    + tset->nr_tasks = 0;
    + tset->csets = &tset->src_csets;
    return ret;
    }


    \
     
     \ /
      Last update: 2017-10-10 22:06    [W:2.856 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site