lkml.org 
[lkml]   [2022]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH] sbitmap: fix possible io hung due to lost wakeup
    From
    Date
    在 2022/08/03 20:15, Yu Kuai 写道:
    > From: Yu Kuai <yukuai3@huawei.com>
    >
    > There are two problems can lead to lost wakeup:
    >
    > 1) invalid wakeup on the wrong waitqueue:
    >
    > For example, 2 * wake_batch tags are put, while only wake_batch threads
    > are woken:
    >
    > __sbq_wake_up
    > atomic_cmpxchg -> reset wait_cnt
    > __sbq_wake_up -> decrease wait_cnt
    > ...
    > __sbq_wake_up -> wait_cnt is decreased to 0 again
    > atomic_cmpxchg
    > sbq_index_atomic_inc -> increase wake_index
    > wake_up_nr -> wake up and waitqueue might be empty
    > sbq_index_atomic_inc -> increase again, one waitqueue is skipped
    > wake_up_nr -> invalid wake up because old wakequeue might be empty
    >
    > To fix the problem, increasing 'wake_index' before resetting 'wait_cnt'.
    >
    > 2) 'wait_cnt' can be decreased while waitqueue is empty
    >
    > As pointed out by Jan Kara, following race is possible:
    >
    > CPU1 CPU2
    > __sbq_wake_up __sbq_wake_up
    > sbq_wake_ptr() sbq_wake_ptr() -> the same
    > wait_cnt = atomic_dec_return()
    > /* decreased to 0 */
    > sbq_index_atomic_inc()
    > /* move to next waitqueue */
    > atomic_set()
    > /* reset wait_cnt */
    > wake_up_nr()
    > /* wake up on the old waitqueue */
    > wait_cnt = atomic_dec_return()
    > /*
    > * decrease wait_cnt in the old
    > * waitqueue, while it can be
    > * empty.
    > */
    >
    > Fix the problem by waking up before updating 'wake_index' and
    > 'wait_cnt'.
    >
    > With this patch, noted that 'wait_cnt' is still decreased in the old
    > empty waitqueue, however, the wakeup is redirected to a active waitqueue,
    > and the extra decrement on the old empty waitqueue is not handled.

    friendly ping ...
    >
    > Fixes: 88459642cba4 ("blk-mq: abstract tag allocation out into sbitmap library")
    > Signed-off-by: Yu Kuai <yukuai3@huawei.com>
    > Reviewed-by: Jan Kara <jack@suse.cz>
    > ---
    > Changes in official version:
    > - fix spelling mistake in comments
    > - add review tag
    > Changes in rfc v4:
    > - remove patch 1, which improve fairness with overhead
    > - merge patch2 and patch 3
    > Changes in rfc v3:
    > - rename patch 2, and add some comments.
    > - add patch 3, which fixes a new issue pointed out by Jan Kara.
    > Changes in rfc v2:
    > - split to spearate patches for different problem.
    > - add fix tag
    >
    > previous versions:
    > rfc v1: https://lore.kernel.org/all/20220617141125.3024491-1-yukuai3@huawei.com/
    > rfc v2: https://lore.kernel.org/all/20220619080309.1630027-1-yukuai3@huawei.com/
    > rfc v3: https://lore.kernel.org/all/20220710042200.20936-1-yukuai1@huaweicloud.com/
    > rfc v4: https://lore.kernel.org/all/20220723024122.2990436-1-yukuai1@huaweicloud.com/
    > lib/sbitmap.c | 55 ++++++++++++++++++++++++++++++---------------------
    > 1 file changed, 33 insertions(+), 22 deletions(-)
    >
    > diff --git a/lib/sbitmap.c b/lib/sbitmap.c
    > index 29eb0484215a..1aa55806f6a5 100644
    > --- a/lib/sbitmap.c
    > +++ b/lib/sbitmap.c
    > @@ -611,32 +611,43 @@ static bool __sbq_wake_up(struct sbitmap_queue *sbq)
    > return false;
    >
    > wait_cnt = atomic_dec_return(&ws->wait_cnt);
    > - if (wait_cnt <= 0) {
    > - int ret;
    > + /*
    > + * For concurrent callers of this, callers should call this function
    > + * again to wakeup a new batch on a different 'ws'.
    > + */
    > + if (wait_cnt < 0 || !waitqueue_active(&ws->wait))
    > + return true;
    >
    > - wake_batch = READ_ONCE(sbq->wake_batch);
    > + if (wait_cnt > 0)
    > + return false;
    >
    > - /*
    > - * Pairs with the memory barrier in sbitmap_queue_resize() to
    > - * ensure that we see the batch size update before the wait
    > - * count is reset.
    > - */
    > - smp_mb__before_atomic();
    > + wake_batch = READ_ONCE(sbq->wake_batch);
    >
    > - /*
    > - * For concurrent callers of this, the one that failed the
    > - * atomic_cmpxhcg() race should call this function again
    > - * to wakeup a new batch on a different 'ws'.
    > - */
    > - ret = atomic_cmpxchg(&ws->wait_cnt, wait_cnt, wake_batch);
    > - if (ret == wait_cnt) {
    > - sbq_index_atomic_inc(&sbq->wake_index);
    > - wake_up_nr(&ws->wait, wake_batch);
    > - return false;
    > - }
    > + /*
    > + * Wake up first in case that concurrent callers decrease wait_cnt
    > + * while waitqueue is empty.
    > + */
    > + wake_up_nr(&ws->wait, wake_batch);
    >
    > - return true;
    > - }
    > + /*
    > + * Pairs with the memory barrier in sbitmap_queue_resize() to
    > + * ensure that we see the batch size update before the wait
    > + * count is reset.
    > + *
    > + * Also pairs with the implicit barrier between decrementing wait_cnt
    > + * and checking for waitqueue_active() to make sure waitqueue_active()
    > + * sees result of the wakeup if atomic_dec_return() has seen the result
    > + * of atomic_set().
    > + */
    > + smp_mb__before_atomic();
    > +
    > + /*
    > + * Increase wake_index before updating wait_cnt, otherwise concurrent
    > + * callers can see valid wait_cnt in old waitqueue, which can cause
    > + * invalid wakeup on the old waitqueue.
    > + */
    > + sbq_index_atomic_inc(&sbq->wake_index);
    > + atomic_set(&ws->wait_cnt, wake_batch);
    >
    > return false;
    > }
    >

    \
     
     \ /
      Last update: 2022-08-13 08:00    [W:2.352 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site