for-5.16-fixes contains two subtle race conditions which were introduced by scheduler side code cleanups. The branch didn't get pushed out, so merge into for-5.17.
Showing the changes to kernel/workqueue.c (1 of 1 file). Show all
Unified · Split
| @@ -864,8 +864,17 @@ void wq_worker_running(struct task_struct *task) · 863 unmodified lines | ||
| 864 | 864 | |
| 865 | 865 | if (!worker->sleeping) |
| 866 | 866 | return; |
| 867 | + | |
| 868 | + /* | |
| 869 | + * If preempted by unbind_workers() between the WORKER_NOT_RUNNING check | |
| 870 | + * and the nr_running increment below, we may ruin the nr_running reset | |
| 871 | + * and leave with an unexpected pool->nr_running == 1 on the newly unbound | |
| 872 | + * pool. Protect against such race. | |
| 873 | + */ | |
| 874 | + preempt_disable(); | |
| 867 | 875 | if (!(worker->flags & WORKER_NOT_RUNNING)) |
| 868 | 876 | atomic_inc(&worker->pool->nr_running); |
| 877 | + preempt_enable(); | |
| 869 | 878 | worker->sleeping = 0; |
| 870 | 879 | } |
| 871 | 880 | |
| @@ -898,6 +907,16 @@ void wq_worker_sleeping(struct task_struct *task) · 26 unmodified lines | ||
| 898 | 907 | worker->sleeping = 1; |
| 899 | 908 | raw_spin_lock_irq(&pool->lock); |
| 900 | 909 | |
| 910 | + /* | |
| 911 | + * Recheck in case unbind_workers() preempted us. We don't | |
| 912 | + * want to decrement nr_running after the worker is unbound | |
| 913 | + * and nr_running has been reset. | |
| 914 | + */ | |
| 915 | + if (worker->flags & WORKER_NOT_RUNNING) { | |
| 916 | + raw_spin_unlock_irq(&pool->lock); | |
| 917 | + return; | |
| 918 | + } | |
| 919 | + | |
| 901 | 920 | /* |
| 902 | 921 | * The counterpart of the following dec_and_test, implied mb, |
| 903 | 922 | * worklist not empty test sequence is in insert_work(). |
| @@ -1526,7 +1545,8 @@ out: · 622 unmodified lines | ||
| 1526 | 1545 | * @work: work to queue |
| 1527 | 1546 | * |
| 1528 | 1547 | * We queue the work to a specific CPU, the caller must ensure it |
| 1529 | − * can't go away. | |
| 1548 | + * can't go away. Callers that fail to ensure that the specified | |
| 1549 | + * CPU cannot go away will execute on a randomly chosen CPU. | |
| 1530 | 1550 | * |
| 1531 | 1551 | * Return: %false if @work was already on a queue, %true otherwise. |
| 1532 | 1552 | */ |