try_to_wake_up() has a problem which may change status from TASK_DEAD to TASK_RUNNING in race condition with SMI or guest environment of virtual machine. As a result, exited task is scheduled() again and panic occurs. Here is the sequence how it occurs: ----------------------------------+----------------------------- | CPU A | CPU B ----------------------------------+----------------------------- TASK A calls exit().... do_exit() exit_mm() down_read(mm->mmap_sem); rwsem_down_failed_common() set TASK_UNINTERRUPTIBLE set waiter.task <= task A list_add to sem->wait_list : raw_spin_unlock_irq() (I/O interruption occured) __rwsem_do_wake(mmap_sem) list_del(&waiter->list); waiter->task = NULL wake_up_process(task A) try_to_wake_up() (task is still TASK_UNINTERRUPTIBLE) p->on_rq is still 1.) ttwu_do_wakeup() (*A) : (I/O interruption handler finished) if (!waiter.task) schedule() is not called due to waiter.task is NULL. tsk->state = TASK_RUNNING : check_preempt_curr(); : task->state = TASK_DEAD (*B) <--- set TASK_RUNNING (*C) schedule() (exit task is running again) BUG_ON() is called! -------------------------------------------------------- The execution time between (*A) and (*B) is usually very short, because the interruption is disabled, and setting TASK_RUNNING at (*C) must be executed before setting TASK_DEAD. HOWEVER, if SMI is interrupted between (*A) and (*B), (*C) is able to execute AFTER setting TASK_DEAD! Then, exited task is scheduled again, and BUG_ON() is called.... If the system works on guest system of virtual machine, the time between (*A) and (*B) may be also long due to scheduling of hypervisor, and same phenomenon can occur. By this patch, do_exit() waits for releasing task->pi_lock which is used in try_to_wake_up(). It guarantees the task becomes TASK_DEAD after waking up.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -1038,6 +1038,22 @@ void do_exit(long code) · 1037 unmodified lines | |||
| 1038 | if (tsk->nr_dirtied) | 1038 | if (tsk->nr_dirtied) |
| 1039 | __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied); | 1039 | __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied); |
| 1040 | exit_rcu(); | 1040 | exit_rcu(); |
| 1041 | |||
| 1042 | /* | ||
| 1043 | * The setting of TASK_RUNNING by try_to_wake_up() may be delayed | ||
| 1044 | * when the following two conditions become true. | ||
| 1045 | * - There is race condition of mmap_sem (It is acquired by | ||
| 1046 | * exit_mm()), and | ||
| 1047 | * - SMI occurs before setting TASK_RUNINNG. | ||
| 1048 | * (or hypervisor of virtual machine switches to other guest) | ||
| 1049 | * As a result, we may become TASK_RUNNING after becoming TASK_DEAD | ||
| 1050 | * | ||
| 1051 | * To avoid it, we have to wait for releasing tsk->pi_lock which | ||
| 1052 | * is held by try_to_wake_up() | ||
| 1053 | */ | ||
| 1054 | smp_mb(); | ||
| 1055 | raw_spin_unlock_wait(&tsk->pi_lock); | ||
| 1056 | |||
| 1041 | /* causes final put_task_struct in finish_task_switch(). */ | 1057 | /* causes final put_task_struct in finish_task_switch(). */ |
| 1042 | tsk->state = TASK_DEAD; | 1058 | tsk->state = TASK_DEAD; |
| 1043 | tsk->flags |= PF_NOFREEZE; /* tell freezer to ignore us */ | 1059 | tsk->flags |= PF_NOFREEZE; /* tell freezer to ignore us */ |