From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84CAD1E52D; Thu, 21 Nov 2024 11:36:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.92.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732189000; cv=none; b=eL6lFaxmxvRoDeGgJEq5s3ad8nqFo7RTgZZRIDRAPwIppR6quMC4Kg6qGWvGobEevP0e239hmdGL5/VkTxq0NfmeRU63W7+/IWFHzPBRJYojxU9zz5W7TsYke7Sv8Cvs9ValFJhu4vqzFZ2KCQddzblwvpQnwN8v95Zb+y/MDKM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732189000; c=relaxed/simple; bh=LbZQYk84BXacNPIxR5ZjcaQUtezDv/lcCXofOdgV4Zg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=TcVN5faXo01dGgt6rhSBR0IIdp2PBd6z82vchWFczWj/eiFQW7QDLATbF5s4asbPr9VESC+pWOt54HBJgrb/dhWHjkCvtzbuz6CJ7GM+MUrD1sMVNU2FkPSQfv5UTOnjTah4aJTdlyDvpTokAzfi9jMyNAP4l/Vh8GTLzf24PIw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=Bql3r4NW; arc=none smtp.client-ip=90.155.92.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="Bql3r4NW" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=LS6+dcL7H0Nwp8T0TKzgyearEgOQ/YIKFVEH6/AJ1c0=; b=Bql3r4NW/oN5F/KLQZCbdU8C7c 5yTQugrq9Mc1Jlbtb5Y/umQYQpvy4CE6HpJ/dYffqERxcycWdMkORlR+8eBYSL/5UMUSlHMA26wch e2Trg5Ze9RgmmdqSZzEzI5k9Tn/OO7XQPYo3mmBz9yJztkYB3z19SrlVhXp0cH/hP3hn4raqBOXAY /znOOqKox9jTJw3DIMfVLn0GCYfD7vtCzo3qt+Uj7s/qbxVR/Fp5OcA0akpXS/97dLf7IfTiIuhIT y63ZdlMWHJAF0IqLzyWX9Lu3gvpAmc/ggAged4re91TWxasJB4puDBYST2YRKFjUeLRlTeboDdCqI BPPGSoug==; Received: from j130084.upc-j.chello.nl ([24.132.130.84] helo=noisy.programming.kicks-ass.net) by desiato.infradead.org with esmtpsa (Exim 4.98 #2 (Red Hat Linux)) id 1tE5U5-00000000ZlQ-3pmS; Thu, 21 Nov 2024 11:36:30 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id 8AB5430068B; Thu, 21 Nov 2024 12:36:29 +0100 (CET) Date: Thu, 21 Nov 2024 12:36:29 +0100 From: Peter Zijlstra To: John Stultz Cc: LKML , Joel Fernandes , Qais Yousef , Ingo Molnar , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Valentin Schneider , Steven Rostedt , Benjamin Segall , Zimuzo Ezeozue , Mel Gorman , Will Deacon , Waiman Long , Boqun Feng , "Paul E. McKenney" , Metin Kaya , Xuewen Yan , K Prateek Nayak , Thomas Gleixner , Daniel Lezcano , kernel-team@android.com, Davidlohr Bueso , regressions@lists.linux.dev, Thorsten Leemhuis , Anders Roxell , Arnd Bergmann Subject: Re: [RESEND][PATCH] locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex Message-ID: <20241121113629.GH24774@noisy.programming.kicks-ass.net> References: <20241120184625.3835422-1-jstultz@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20241120184625.3835422-1-jstultz@google.com> On Wed, Nov 20, 2024 at 10:46:15AM -0800, John Stultz wrote: > Anders had bisected a crash using PREEMPT_RT with linux-next and > isolated it down to commit 894d1b3db41c ("locking/mutex: Remove > wakeups from under mutex::wait_lock"), where it seemed the > wake_q structure was somehow getting corrupted causing a null > pointer traversal. > > I was able to easily repoduce this with PREEMPT_RT and managed > to isolate down that through various call stacks we were > actually calling wake_up_q() twice on the same wake_q. > > I found that in the problematic commit, I had added the > wake_up_q() call in task_blocks_on_rt_mutex() around > __ww_mutex_add_waiter(), following a similar pattern in > __mutex_lock_common(). > > However, its just wrong. We haven't dropped the lock->wait_lock, > so its contrary to the point of the original patch. And it > didn't match the __mutex_lock_common() logic of re-initializing > the wake_q after calling it midway in the stack. > > Looking at it now, the wake_up_q() call is incorrect and should > just be removed. So drop the erronious logic I had added. > > Cc: Peter Zijlstra > Cc: Joel Fernandes > Cc: Qais Yousef > Cc: Ingo Molnar > Cc: Juri Lelli > Cc: Vincent Guittot > Cc: Dietmar Eggemann > Cc: Valentin Schneider > Cc: Steven Rostedt > Cc: Benjamin Segall > Cc: Zimuzo Ezeozue > Cc: Mel Gorman > Cc: Will Deacon > Cc: Waiman Long > Cc: Boqun Feng > Cc: "Paul E. McKenney" > Cc: Metin Kaya > Cc: Xuewen Yan > Cc: K Prateek Nayak > Cc: Thomas Gleixner > Cc: Daniel Lezcano > Cc: kernel-team@android.com > Cc: Davidlohr Bueso > Cc: regressions@lists.linux.dev > Cc: Thorsten Leemhuis > Cc: Anders Roxell > Fixes: 894d1b3db41c ("locking/mutex: Remove wakeups from under mutex::wait_lock") > Reported-by: Anders Roxell > Reported-by: Arnd Bergmann > Closes: https://lore.kernel.org/lkml/6afb936f-17c7-43fa-90e0-b9e780866097@app.fastmail.com/ > Tested-by: Anders Roxell > Tested-by: K Prateek Nayak > Reviewed-by: Juri Lelli > Signed-off-by: John Stultz > --- > Apologies for being noisy, I recognize its only been a week, but > I wanted to resend this now as the problematic commit just > landed in Linus' tree and I've not seen this get queued yet. Right, I picked up the old one a few days ago, but will not be sticking it in any git tree until -rc1.