try_to_wake_up() has a problem which may change status from TASK_DEAD to TASK_RUNNING in race condition with SMI or guest environment of virtual machine. As a result, exited task is scheduled() again and panic occurs. Here is the sequence how it occurs: ----------------------------------+----------------------------- | CPU A | CPU B ----------------------------------+----------------------------- TASK A calls exit().... do_exit() exit_mm() down_read(mm->mmap_sem); rwsem_down_failed_common() set TASK_UNINTERRUPTIBLE set waiter.task <= task A list_add to sem->wait_list : raw_spin_unlock_irq() (I/O interruption occured) __rwsem_do_wake(mmap_sem) list_del(&waiter->list); waiter->task = NULL wake_up_process(task A) try_to_wake_up() (task is still TASK_UNINTERRUPTIBLE) p->on_rq is still 1.) ttwu_do_wakeup() (*A) : (I/O interruption handler finished) if (!waiter.task) schedule() is not called due to waiter.task is NULL. tsk->state = TASK_RUNNING : check_preempt_curr(); : task->state = TASK_DEAD (*B) <--- set TASK_RUNNING (*C) schedule() (exit task is running again) BUG_ON() is called! -------------------------------------------------------- The execution time between (*A) and (*B) is usually very short, because the interruption is disabled, and setting TASK_RUNNING at (*C) must be executed before setting TASK_DEAD. HOWEVER, if SMI is interrupted between (*A) and (*B), (*C) is able to execute AFTER setting TASK_DEAD! Then, exited task is scheduled again, and BUG_ON() is called.... If the system works on guest system of virtual machine, the time between (*A) and (*B) may be also long due to scheduling of hypervisor, and same phenomenon can occur. By this patch, do_exit() waits for releasing task->pi_lock which is used in try_to_wake_up(). It guarantees the task becomes TASK_DEAD after waking up.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -1038,6 +1038,22 @@ void do_exit(long code) · 1037 unmodified lines | ||
| 1038 | 1038 | if (tsk->nr_dirtied) |
| 1039 | 1039 | __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied); |
| 1040 | 1040 | exit_rcu(); |
| 1041 | + | |
| 1042 | + /* | |
| 1043 | + * The setting of TASK_RUNNING by try_to_wake_up() may be delayed | |
| 1044 | + * when the following two conditions become true. | |
| 1045 | + * - There is race condition of mmap_sem (It is acquired by | |
| 1046 | + * exit_mm()), and | |
| 1047 | + * - SMI occurs before setting TASK_RUNINNG. | |
| 1048 | + * (or hypervisor of virtual machine switches to other guest) | |
| 1049 | + * As a result, we may become TASK_RUNNING after becoming TASK_DEAD | |
| 1050 | + * | |
| 1051 | + * To avoid it, we have to wait for releasing tsk->pi_lock which | |
| 1052 | + * is held by try_to_wake_up() | |
| 1053 | + */ | |
| 1054 | + smp_mb(); | |
| 1055 | + raw_spin_unlock_wait(&tsk->pi_lock); | |
| 1056 | + | |
| 1041 | 1057 | /* causes final put_task_struct in finish_task_switch(). */ |
| 1042 | 1058 | tsk->state = TASK_DEAD; |
| 1043 | 1059 | tsk->flags |= PF_NOFREEZE; /* tell freezer to ignore us */ |