In the CPU-offline process, it calls mmdrop() after idle entry and the subsequent call to cpuhp_report_idle_dead(). Once execution passes the call to rcu_report_dead(), RCU is ignoring the CPU, which results in lockdep complaining when mmdrop() uses RCU from either memcg or debugobjects below. Fix it by cleaning up the active_mm state from BP instead. Every arch which has CONFIG_HOTPLUG_CPU should have already called idle_task_exit() from AP. The only exception is parisc because it switches them to &init_mm unconditionally (see smp_boot_one_cpu() and smp_cpu_init()), but the patch will still work there because it calls mmgrab(&init_mm) in smp_cpu_init() and then should call mmdrop(&init_mm) in finish_cpu(). WARNING: suspicious RCU usage ----------------------------- kernel/workqueue.c:710 RCU or wq_pool_mutex should be held! other info that might help us debug this: RCU used illegally from offline CPU! Call Trace: dump_stack+0xf4/0x164 (unreliable) lockdep_rcu_suspicious+0x140/0x164 get_work_pool+0x110/0x150 __queue_work+0x1bc/0xca0 queue_work_on+0x114/0x120 css_release+0x9c/0xc0 percpu_ref_put_many+0x204/0x230 free_pcp_prepare+0x264/0x570 free_unref_page+0x38/0xf0 __mmdrop+0x21c/0x2c0 idle_task_exit+0x170/0x1b0 pnv_smp_cpu_kill_self+0x38/0x2e0 cpu_die+0x48/0x64 arch_cpu_idle_dead+0x30/0x50 do_idle+0x2f4/0x470 cpu_startup_entry+0x38/0x40 start_secondary+0x7a8/0xa80 start_secondary_resume+0x10/0x14
Unified · Split
| @@ -167,7 +167,6 @@ static void pnv_smp_cpu_kill_self(void) · 166 unmodified lines | |||
| 167 | /* Standard hot unplug procedure */ | 167 | /* Standard hot unplug procedure */ |
| 168 | 168 | ||
| 169 | idle_task_exit(); | 169 | idle_task_exit(); |
| 170 | current->active_mm = NULL; /* for sanity */ | ||
| 171 | cpu = smp_processor_id(); | 170 | cpu = smp_processor_id(); |
| 172 | DBG("CPU%d offline\n", cpu); | 171 | DBG("CPU%d offline\n", cpu); |
| 173 | generic_set_cpu_dead(cpu); | 172 | generic_set_cpu_dead(cpu); |
| @@ -49,6 +49,8 @@ static inline void mmdrop(struct mm_struct *mm) · 48 unmodified lines | |||
| 49 | __mmdrop(mm); | 49 | __mmdrop(mm); |
| 50 | } | 50 | } |
| 51 | 51 | ||
| 52 | void mmdrop(struct mm_struct *mm); | ||
| 53 | |||
| 52 | /* | 54 | /* |
| 53 | * This has to be called after a get_task_mm()/mmget_not_zero() | 55 | * This has to be called after a get_task_mm()/mmget_not_zero() |
| 54 | * followed by taking the mmap_sem for writing before modifying the | 56 | * followed by taking the mmap_sem for writing before modifying the |
| @@ -3,6 +3,7 @@ · 2 unmodified lines | |||
| 3 | * | 3 | * |
| 4 | * This code is licenced under the GPL. | 4 | * This code is licenced under the GPL. |
| 5 | */ | 5 | */ |
| 6 | #include <linux/sched/mm.h> | ||
| 6 | #include <linux/proc_fs.h> | 7 | #include <linux/proc_fs.h> |
| 7 | #include <linux/smp.h> | 8 | #include <linux/smp.h> |
| 8 | #include <linux/init.h> | 9 | #include <linux/init.h> |
| @@ -564,6 +565,21 @@ static int bringup_cpu(unsigned int cpu) · 555 unmodified lines | |||
| 564 | return bringup_wait_for_ap(cpu); | 565 | return bringup_wait_for_ap(cpu); |
| 565 | } | 566 | } |
| 566 | 567 | ||
| 568 | static int finish_cpu(unsigned int cpu) | ||
| 569 | { | ||
| 570 | struct task_struct *idle = idle_thread_get(cpu); | ||
| 571 | struct mm_struct *mm = idle->active_mm; | ||
| 572 | |||
| 573 | /* | ||
| 574 | * idle_task_exit() will have switched to &init_mm, now | ||
| 575 | * clean up any remaining active_mm state. | ||
| 576 | */ | ||
| 577 | if (mm != &init_mm) | ||
| 578 | idle->active_mm = &init_mm; | ||
| 579 | mmdrop(mm); | ||
| 580 | return 0; | ||
| 581 | } | ||
| 582 | |||
| 567 | /* | 583 | /* |
| 568 | * Hotplug state machine related functions | 584 | * Hotplug state machine related functions |
| 569 | */ | 585 | */ |
| @@ -1549,7 +1565,7 @@ static struct cpuhp_step cpuhp_hp_states[] = { · 979 unmodified lines | |||
| 1549 | [CPUHP_BRINGUP_CPU] = { | 1565 | [CPUHP_BRINGUP_CPU] = { |
| 1550 | .name = "cpu:bringup", | 1566 | .name = "cpu:bringup", |
| 1551 | .startup.single = bringup_cpu, | 1567 | .startup.single = bringup_cpu, |
| 1552 | .teardown.single = NULL, | 1568 | .teardown.single = finish_cpu, |
| 1553 | .cant_stop = true, | 1569 | .cant_stop = true, |
| 1554 | }, | 1570 | }, |
| 1555 | /* Final state before CPU kills itself */ | 1571 | /* Final state before CPU kills itself */ |
| @@ -6197,13 +6197,14 @@ void idle_task_exit(void) · 6196 unmodified lines | |||
| 6197 | struct mm_struct *mm = current->active_mm; | 6197 | struct mm_struct *mm = current->active_mm; |
| 6198 | 6198 | ||
| 6199 | BUG_ON(cpu_online(smp_processor_id())); | 6199 | BUG_ON(cpu_online(smp_processor_id())); |
| 6200 | BUG_ON(current != this_rq()->idle); | ||
| 6200 | 6201 | ||
| 6201 | if (mm != &init_mm) { | 6202 | if (mm != &init_mm) { |
| 6202 | switch_mm(mm, &init_mm, current); | 6203 | switch_mm(mm, &init_mm, current); |
| 6203 | current->active_mm = &init_mm; | ||
| 6204 | finish_arch_post_lock_switch(); | 6204 | finish_arch_post_lock_switch(); |
| 6205 | } | 6205 | } |
| 6206 | mmdrop(mm); | 6206 | |
| 6207 | /* finish_cpu(), as ran on the BP, will clean up the active_mm state */ | ||
| 6207 | } | 6208 | } |
| 6208 | 6209 | ||
| 6209 | /* | 6210 | /* |