From patchwork Tue Oct 26 08:43:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yuanzheng Song X-Patchwork-Id: 12584147 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BB7AC433EF for ; Tue, 26 Oct 2021 08:28:31 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 172C560F92 for ; Tue, 26 Oct 2021 08:28:31 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 172C560F92 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=huawei.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 78E04940008; Tue, 26 Oct 2021 04:28:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7178C940007; Tue, 26 Oct 2021 04:28:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5B881940008; Tue, 26 Oct 2021 04:28:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0227.hostedemail.com [216.40.44.227]) by kanga.kvack.org (Postfix) with ESMTP id 495A7940007 for ; Tue, 26 Oct 2021 04:28:30 -0400 (EDT) Received: from smtpin21.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id D93F1180ACF8F for ; Tue, 26 Oct 2021 08:28:29 +0000 (UTC) X-FDA: 78737911938.21.9386144 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by imf22.hostedemail.com (Postfix) with ESMTP id BC3041901 for ; Tue, 26 Oct 2021 08:28:28 +0000 (UTC) Received: from dggemv704-chm.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4HdlGB6Md8zbn9y; Tue, 26 Oct 2021 16:23:46 +0800 (CST) Received: from dggpeml500026.china.huawei.com (7.185.36.106) by dggemv704-chm.china.huawei.com (10.3.19.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Tue, 26 Oct 2021 16:28:24 +0800 Received: from localhost.localdomain (10.175.112.125) by dggpeml500026.china.huawei.com (7.185.36.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Tue, 26 Oct 2021 16:28:24 +0800 From: Yuanzheng Song To: , , , , , , Subject: [PATCH -next v2] mm/percpu: fix data-race with pcpu_nr_empty_pop_pages Date: Tue, 26 Oct 2021 08:43:12 +0000 Message-ID: <20211026084312.2138852-1-songyuanzheng@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.112.125] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To dggpeml500026.china.huawei.com (7.185.36.106) X-CFilter-Loop: Reflected X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: BC3041901 X-Stat-Signature: um7sap68qb4sc3p4437dhdxi8pc774ib Authentication-Results: imf22.hostedemail.com; dkim=none; spf=pass (imf22.hostedemail.com: domain of songyuanzheng@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=songyuanzheng@huawei.com; dmarc=pass (policy=none) header.from=huawei.com X-HE-Tag: 1635236908-386106 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When reading the pcpu_nr_empty_pop_pages in pcpu_alloc() and writing the pcpu_nr_empty_pop_pages in pcpu_update_empty_pages() at the same time, the data-race occurs. =========== read-write to 0xffffffff882fdd4c of 4 bytes by task 9424 on cpu 0: pcpu_update_empty_pages pcpu_chunk_populated pcpu_balance_populated pcpu_balance_workfn process_one_work worker_thread kthread ret_from_fork read to 0xffffffff882fdd4c of 4 bytes by task 9386 on cpu 3: pcpu_alloc __alloc_percpu_gfp fib_nh_common_init fib_nh_init fib_create_info fib_table_insert fib_magic ...... sock_sendmsg_nosec sock_sendmsg __sys_sendto __do_sys_sendto __se_sys_sendto __x64_sys_sendto do_syscall_64 entry_SYSCALL_64_after_hwframe ============ The same problem will occur in these functions: pcpu_reclaim_populated(), pcpu_update_empty_pages(), pcpu_isolate_chunk(). Using atomic variable operations to slove this concurrent access problem. Signed-off-by: Yuanzheng Song --- Changes since v1: - Change the pcpu_nr_empty_pop_pages to atomic variable suggested by Christoph Lameter mm/percpu-internal.h | 2 +- mm/percpu-stats.c | 2 +- mm/percpu-vm.c | 2 +- mm/percpu.c | 18 ++++++++++-------- 4 files changed, 13 insertions(+), 11 deletions(-) diff --git a/mm/percpu-internal.h b/mm/percpu-internal.h index 639662c20c82..02fbc11ef68a 100644 --- a/mm/percpu-internal.h +++ b/mm/percpu-internal.h @@ -72,7 +72,7 @@ extern struct list_head *pcpu_chunk_lists; extern int pcpu_nr_slots; extern int pcpu_sidelined_slot; extern int pcpu_to_depopulate_slot; -extern int pcpu_nr_empty_pop_pages; +extern atomic_t pcpu_nr_empty_pop_pages; extern struct pcpu_chunk *pcpu_first_chunk; extern struct pcpu_chunk *pcpu_reserved_chunk; diff --git a/mm/percpu-stats.c b/mm/percpu-stats.c index c6bd092ff7a3..7bd601fd3b6b 100644 --- a/mm/percpu-stats.c +++ b/mm/percpu-stats.c @@ -188,7 +188,7 @@ static int percpu_stats_show(struct seq_file *m, void *v) PU(nr_max_chunks); PU(min_alloc_size); PU(max_alloc_size); - P("empty_pop_pages", pcpu_nr_empty_pop_pages); + P("empty_pop_pages", atomic_read(&pcpu_nr_empty_pop_pages)); seq_putc(m, '\n'); #undef PU diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c index 2054c9213c43..12b2342448f4 100644 --- a/mm/percpu-vm.c +++ b/mm/percpu-vm.c @@ -404,7 +404,7 @@ static bool pcpu_should_reclaim_chunk(struct pcpu_chunk *chunk) * chunk, move it to the to_depopulate list. */ return ((chunk->isolated && chunk->nr_empty_pop_pages) || - (pcpu_nr_empty_pop_pages > + (atomic_read(&pcpu_nr_empty_pop_pages) > (PCPU_EMPTY_POP_PAGES_HIGH + chunk->nr_empty_pop_pages) && chunk->nr_empty_pop_pages >= chunk->nr_pages / 4)); } diff --git a/mm/percpu.c b/mm/percpu.c index 293009cc03ef..0c55a25059a2 100644 --- a/mm/percpu.c +++ b/mm/percpu.c @@ -181,7 +181,7 @@ static LIST_HEAD(pcpu_map_extend_chunks); * The number of empty populated pages, protected by pcpu_lock. * The reserved chunk doesn't contribute to the count. */ -int pcpu_nr_empty_pop_pages; +atomic_t pcpu_nr_empty_pop_pages = ATOMIC_INIT(0); /* * The number of populated pages in use by the allocator, protected by @@ -574,7 +574,7 @@ static void pcpu_isolate_chunk(struct pcpu_chunk *chunk) if (!chunk->isolated) { chunk->isolated = true; - pcpu_nr_empty_pop_pages -= chunk->nr_empty_pop_pages; + atomic_sub(chunk->nr_empty_pop_pages, &pcpu_nr_empty_pop_pages); } list_move(&chunk->list, &pcpu_chunk_lists[pcpu_to_depopulate_slot]); } @@ -585,7 +585,7 @@ static void pcpu_reintegrate_chunk(struct pcpu_chunk *chunk) if (chunk->isolated) { chunk->isolated = false; - pcpu_nr_empty_pop_pages += chunk->nr_empty_pop_pages; + atomic_add(chunk->nr_empty_pop_pages, &pcpu_nr_empty_pop_pages); pcpu_chunk_relocate(chunk, -1); } } @@ -603,7 +603,7 @@ static inline void pcpu_update_empty_pages(struct pcpu_chunk *chunk, int nr) { chunk->nr_empty_pop_pages += nr; if (chunk != pcpu_reserved_chunk && !chunk->isolated) - pcpu_nr_empty_pop_pages += nr; + atomic_add(nr, &pcpu_nr_empty_pop_pages); } /* @@ -1874,7 +1874,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, mutex_unlock(&pcpu_alloc_mutex); } - if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW) + if (atomic_read(&pcpu_nr_empty_pop_pages) < PCPU_EMPTY_POP_PAGES_LOW) pcpu_schedule_balance_work(); /* clear the areas and return address relative to base address */ @@ -2062,7 +2062,7 @@ static void pcpu_balance_populated(void) pcpu_atomic_alloc_failed = false; } else { nr_to_pop = clamp(PCPU_EMPTY_POP_PAGES_HIGH - - pcpu_nr_empty_pop_pages, + atomic_read(&pcpu_nr_empty_pop_pages), 0, PCPU_EMPTY_POP_PAGES_HIGH); } @@ -2163,7 +2163,8 @@ static void pcpu_reclaim_populated(void) break; /* reintegrate chunk to prevent atomic alloc failures */ - if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_HIGH) { + if (atomic_read(&pcpu_nr_empty_pop_pages) < + PCPU_EMPTY_POP_PAGES_HIGH) { reintegrate = true; goto end_chunk; } @@ -2765,7 +2766,8 @@ void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai, /* link the first chunk in */ pcpu_first_chunk = chunk; - pcpu_nr_empty_pop_pages = pcpu_first_chunk->nr_empty_pop_pages; + atomic_set(&pcpu_nr_empty_pop_pages, + pcpu_first_chunk->nr_empty_pop_pages); pcpu_chunk_relocate(pcpu_first_chunk, -1); /* include all regions of the first chunk */