From nobody Wed Feb 5 17:56:41 2025 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (mail-co1nam11on2069.outbound.protection.outlook.com [40.107.220.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1255924A7C2 for ; Thu, 16 Jan 2025 11:51:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.220.69 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737028274; cv=fail; b=YALxoMxtL9bX4HR7qt3XlQBBrfIvsb4u2Q2VEzglOd0CrACYNGbsMdyzsEBYC+oNybYW9ACBFlnA9XL1ru6GQ14Z8JAsAByjnfpMB9NE1xLr6kP1KBNxG54Ln4FZCJPAW5gWnF4h96wGIfVtpPXTFPWH62qb7/h3dXbo2SXCirA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737028274; c=relaxed/simple; bh=NdI7rPTZ3NfDd7bkOxzigaFsvYbA7h9R+KW2lZ+7iTg=; h=From:To:Cc:Subject:Date:Message-ID:Content-Type:MIME-Version; b=Ipj/47tTkWuBcn+JhwisqDCTISjh//TYJxiYkcoT3I+67UhLvgQ77JBSqCFQ7C0KO+I9j8LJlfErNzMhTbrDbNeD/+mB1jCTfmI8TFvj1bLCdSYVKGjdAGPzfjufxqIbVcdzTXO/7TgEzUBsJksKRtoMveAT+7+w7pQE5UG7hWc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=Iw5hBcmw; arc=fail smtp.client-ip=40.107.220.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="Iw5hBcmw" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mzlZR1/Vp+AjL36zvsaXJQxo6QO5HXPDagR73xcir/s3gDkpCwFM8hWHCbdyb9c0EcfhNMj4lXHFjkBzfeDMxctP4/yA4vgkup9GzrhTbqzsXVUflFaLVx4IgkIyoQO1W1qMKdg+7sO2DHLNS/Y/dcYRSda79/UbqaHN37lU8vm29nkZBesRDtzWrTP9sn9330tcQ2nGnnAnlgx7gaqM67qe3+GkeBJBMWKC8nug+zwnCeKcHZ3CwFAxo88SAJ5P1/aPkP5/Rb5mYqoLZAEM4LaoWWcEWCx1+/DS3AV50XDybTT5+y3gRBRjIr+3fBJUaDRAhUCbziETjIPfamyqbA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zz6smG+YnPHrKnX5O2IEgga9C5rZ6i1U46qSPFlm/kA=; b=kbF9B4id2pFejfXS/VnxWHS2FzlZGK6OjL5V05LhiUusa4fw8ipNzDMTYmfVqQovVt29NPvrd3TrUem1EcLr4QF/b1d4wOI0m7MmfVAxNrtGy0DOnCNYv1EOlStMZgQ0eoPPOTV+dtN9Lh97CjY8QeyytPCaWcrZTCLHX3EcsvfkVOHnmEzgb+ptwgkpHkcahTaZHFQ2US5/RPQbutIbPtVNZUyRDubAgo7pVlKY4cJ5ZJTn0qPgEXQqwrq0BIFNMpXX2O7zrvFP/UvsPHsQaowwF13s1XJEbhIwGmrfiatMbwZtkA+rBdTIGHQVbiHp+80DEnc6FVWtNUxz1UWSfQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zz6smG+YnPHrKnX5O2IEgga9C5rZ6i1U46qSPFlm/kA=; b=Iw5hBcmwHq2/IeKA7bGVJQ/DU33VZe2cp8Udc876mi3x+SAQ/BOWnvtox/x50/pzbCQHLNB8KZTtqWKb2YyMeHSl3vrNdzKeD+5Qk3bHmtm4b6XHtJJd1GH7b7dnMztemgoY3uePcqgUJz4KqiTs34ius0+AmaK/gl84xWmx2YkkFQMgD8Rig2zW6+zL46/NIcesKDMJj2KWLKTR3adkhAzeC8BCmRMYgYWtcETxPDBf7wFTDBvzcECbJ1bCAY7sTuJknfQ8b/ODFQqNeQYW0S0RpEMy6tpnxP6x4FI7e64k+k5vnFzMah2Ux0EliOZanRHURMaGU+vuiWZPFNoCIg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from DM4PR12MB6424.namprd12.prod.outlook.com (2603:10b6:8:be::16) by DS7PR12MB5838.namprd12.prod.outlook.com (2603:10b6:8:79::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8356.13; Thu, 16 Jan 2025 11:51:11 +0000 Received: from DM4PR12MB6424.namprd12.prod.outlook.com ([fe80::8133:5fd9:ff45:d793]) by DM4PR12MB6424.namprd12.prod.outlook.com ([fe80::8133:5fd9:ff45:d793%7]) with mapi id 15.20.8356.010; Thu, 16 Jan 2025 11:51:10 +0000 From: Andrea Righi To: Tejun Heo , David Vernet , Changwoo Min Cc: linux-kernel@vger.kernel.org Subject: [PATCH] sched_ext: Fix potential deadlock in destroy_dsq() Date: Thu, 16 Jan 2025 12:51:01 +0100 Message-ID: <20250116115101.549175-1-arighi@nvidia.com> X-Mailer: git-send-email 2.48.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: FR2P281CA0057.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:93::17) To DM4PR12MB6424.namprd12.prod.outlook.com (2603:10b6:8:be::16) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DM4PR12MB6424:EE_|DS7PR12MB5838:EE_ X-MS-Office365-Filtering-Correlation-Id: b9ec1d06-4d50-49dd-acdf-08dd36241214 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?nLqw9wA1dzOSvi0wLuC1mpzPeyO9qZ4r0+MTx2TRTG+/lgNa2LnBxHEVJMgg?= =?us-ascii?Q?/6x30iIKHWhbMuJW8y5/4bLiQb2upaLBpCv7HMpDUzniY1u9vMLLj+NfMOsK?= =?us-ascii?Q?zlqehlTJyEiBz6Ehy5wCcpEL2LNticvWqnHLy3IhXU8vBGRbmMClSWxeMi2Q?= =?us-ascii?Q?EkYIPgTCnyZaAvavVPG2EQjSj4EDS9VQ0nY4b9JVMJyzYD+pH116DL1hAYQs?= =?us-ascii?Q?vIl25klkbCOt4RPM5P2qUmg2Zb27SgDezxbxGNz9EyZBlBtb/TPw/d/XdhSv?= =?us-ascii?Q?vyOb0+XYP3WNcuXlPD4ZTQkB1Cej+xIXcucA1+StGit3BupS7QBzgbvAMZnO?= =?us-ascii?Q?LfQAFYlrXXQrHW5kbxN6URCJtR2quThrTkviFKdnUjukuAL4IsXVpvfmQdgz?= =?us-ascii?Q?b52UFfaxBlummqNMudVZbEg+qWl85L0wGolhYU8E17jhA8IjfsTsu02322nr?= =?us-ascii?Q?Rxy2KDi/QOJVgu55Lt1ETdKyg2YjX4wuEdzbmwQiS5HYHwFj6d2fq0mJ/f0c?= =?us-ascii?Q?jj4Mdo6cec1rXb+tcwdVV0DQ1vt4miWLajk8Cft+vyW+jZCyc/Y+eh8QklCP?= =?us-ascii?Q?wjSKwijJggB8yxSNt2Xz0rcDRAYfsYvvC75dhJUfnr7ImhEuUTzWdZ716Uu5?= =?us-ascii?Q?XYGMymYZdeEAE5EnAi7KlX1aA/pZ1QKNP2KqZjWLq+s8B27dXbF77rML5b0f?= =?us-ascii?Q?cA99y8Ou4oHRnyTvesJ6BA7RR67S9v1j5tkZZUgktHbkyp8LFDmL8c0qfjGf?= =?us-ascii?Q?kMBdAukhcHj1C3vzoW//J9v4xI5EbFs3DJ+nspjgFALvIZFcPNwifvGJChEU?= =?us-ascii?Q?mVYKehx81cED/HpIhkprpW6/hN7Ce+6qBrY2IDE64XJuVAG8SR/MT8K3Zz1j?= =?us-ascii?Q?rJKt96yZ/fLV9Sl1GO4asLbrZ+5uN3lxYMMH1WtUBxB0nSBVM0fX8sHUpPm4?= =?us-ascii?Q?XrZUfPuR/4EvOG4rM9G7qbthpVwBSkqpsWaisgIndNa72VdF3wVx17Y9MD8E?= =?us-ascii?Q?hcPU/xLCXzU5NLFAAjMZBoaFNvmi6eLiMBaBHBEGq4xAalsvSJVQTD28O8mz?= =?us-ascii?Q?+vKsTuBl1RQtMUbN4kASdECfhBk27JntGSWpeFuUNRuYBjYDB9JGzZVw1Tqf?= =?us-ascii?Q?D7pB6byWAgDnVGQPFC9UmOl4pTRhqGejxJ1Xnuxg/ZwXF9ponzz6SMwPS5L/?= =?us-ascii?Q?vVUut2Os2PbN+eKfYPCCn6JCB8/dvmz4jCLTDli8tIUyWqnmEPYszjgE3vMz?= =?us-ascii?Q?ikbXBQKpm9sw59c5kTpbMSOfM4oru7zeEs9VNzYiXQ/mgsFBbmax3sfzjEh3?= =?us-ascii?Q?eb5h7LHXOMj0AWhqqkhrOi6BAr9rB+tHNyfCmCQ4YX0chlXItBJ3C8e4s5Kn?= =?us-ascii?Q?GOBG1Ibrr50GeeMk2zw3MRRO2ggP?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM4PR12MB6424.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?J9XZNqGaEDDYWiVMrCp5RgLkjwABo/m7rYuu4ABe8jpbJlnU4OLAUEBfBdCx?= =?us-ascii?Q?4x8EferJWFDdWwklE0XIjk+AOR5YjOWPYVYkEcIqKk4YOsCOSMnptuFI62jl?= =?us-ascii?Q?bnPE0eJuoN8tvKPVBv9uYuOLt8DgljGBzhaicDcz1Fbt9Lifl3phl6sxgc14?= =?us-ascii?Q?rCPQdgFl+5iscX8LHBh1bZHuddPg3zP7eYzcx+aHVG0vc7kyx4LbnmatMXaK?= =?us-ascii?Q?n3S71sNE+9CEh7qWm+QjCAS+J4ennym6VaoKW8H/Nb9obj8IclMhjJpxKx14?= =?us-ascii?Q?SSMXN1xJNfISTzsF/9hIk+JfF7Db7frPyC/5s5uhYXum/keTplcfky4njOsk?= =?us-ascii?Q?I+b9F4EDrelPILtf/4aLtTDjUXx6lL5AeF0lZ5Paw0mi6fOKzy0sMSee56pt?= =?us-ascii?Q?p/7kydZidaGlvKAqnv2vxy0wIMeFvRPJC633HGx68cpR/OWiW8mg+Fag5IS3?= =?us-ascii?Q?1Exez08+fs/ObUOgA9YF8rXffKKxpT5Ag1ectbidiK/fEyjMGPhqEspHU3bg?= =?us-ascii?Q?VxWqz79GqM7Hwp2HlO1QoULQbLg9d/LAAAPRXU8unHoRe/o3XirazNmMHtp9?= =?us-ascii?Q?C0jskJO33hVykl/M/rGseA39S4vyqew8F2iX2RQvPTLVWyPHd4sIudT0zUd3?= =?us-ascii?Q?XbqnaUlVtdRHDo0RKOTrTA2K3WNQIATNH6qcjYpYbC18B6cUkw2fYXA6udjO?= =?us-ascii?Q?dIXYOv/uluFMhPyHXldFzbu5Xv+0jqI8KKeU7BY0Cgj4hz7xSgrz3UcfY98r?= =?us-ascii?Q?/U0GnW+BWYknpbbPGxHPMy/4DbzeVjyWyACpdPTHt+Shi6Wl4GECTiP6ITDJ?= =?us-ascii?Q?uP+RIwGkvtYSmwxwzY6Zt/R0rA16tHDlAPhMVGC8eSnsIjKarpw77d8HmTu5?= =?us-ascii?Q?woZ0T9imUIuNd0/uXqs3ZD9MdhpkgHNDA2lrxZS6B+BiRvY8YZwxjJtUl2rl?= =?us-ascii?Q?XNANIbIYFvfNrQ9OudMMe9lLR+hGQlHgGT4dVzrSiwzjgHfWKQXRLXH0jxdp?= =?us-ascii?Q?eAnNvfufQmmHWAfo1fH/FZOAq5y5SErnvbeOYbr5FWmJIPhCu46hA/noWKQa?= =?us-ascii?Q?0oX9m2/F3uIMgYSuQj1U1o6MY32JeLN1qdwqYWKpG6aK4X6IGP57puZ6nyrE?= =?us-ascii?Q?FNA6s4oAIEyVuEZvyPfPDMjc6yIN/pcgowm4RdlqAEpre3kk8WRkhYXMeZRf?= =?us-ascii?Q?PGoGfdLY8HY3p+Lk6A0p+mt81VngSbM+Mr42KHx7Qg8dlYc5qQqCoWEyG2To?= =?us-ascii?Q?F7P7vm84FuR5HGyKSfyanPDnB7exyiGfRC0jcUGKxI7nZXd+x5+8K20ZiaOo?= =?us-ascii?Q?mMFXIS8Ltdcs7trMQLEK7u+8PCEfspO8aH8IWMdDKLkytUT1won3fAQ/jsZQ?= =?us-ascii?Q?Z7vvsMMz7uMjckPJGBzbX7UU9vSEejo2WElQbKJhZ8HLlB+SFnPEaZOSNGHW?= =?us-ascii?Q?lxBIBW5NSs8GjLWdU1i/W/DJVeJsLOofiUlGTihqzIVBrrsVEp3b0Cr8YIr+?= =?us-ascii?Q?5TTndvDscKx7VQFV/zsGWr5uHKYjpZmMozvJPb0f13JVuPJ2wN20MOS/cjcx?= =?us-ascii?Q?dLdLsSFerQbpeqxHWVeKQaHBkT4NztESukRor/uE?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: b9ec1d06-4d50-49dd-acdf-08dd36241214 X-MS-Exchange-CrossTenant-AuthSource: DM4PR12MB6424.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Jan 2025 11:51:10.7908 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8NleuExqZAyNN+VWgO37Uyv9ZK5rGfcobynWKN4n/bt60rkdGZh+ddwCGrVJMIgDkWyjABRoN8Ly+c7ZWEgRvg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB5838 Content-Type: text/plain; charset="utf-8" When creating and destroying DSQs concurrently, a potential deadlock can occur due to a circular locking dependency between the locks involved in the operations: - create_dsq(): rhashtable_bucket --> rq->lock --> dsq->lock - destroy_dsq(): dsq->lock -> rhashtable_bucket This circular dependency is also shown by the following lockdep splat: [ 85.874899] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D [ 85.881304] WARNING: possible circular locking dependency detected [ 85.887710] 6.13.0-rc7-00043-g619f0b6fad52 #3 Not tainted [ 85.893298] ------------------------------------------------------ [ 85.899699] sched_ext_ops_h/2060 is trying to acquire lock: [ 85.905467] ffff000080029838 (rhashtable_bucket){....}-{0:0}, at: destro= y_dsq+0x1b4/0x7f8 [ 85.913960] but task is already holding lock: [ 85.919996] ffff0000a126fed8 (&dsq->lock){-.-.}-{2:2}, at: destroy_dsq+0= x6c/0x7f8 [ 85.927753] which lock already depends on the new lock. ... other info that might help us debug this: [ 86.494385] Chain exists of: rhashtable_bucket --> &rq->__lock --> &dsq->lock [ 86.510168] Possible unsafe locking scenario: [ 86.519784] CPU0 CPU1 [ 86.526184] ---- ---- [ 86.532560] lock(&dsq->lock); [ 86.537487] lock(&rq->__lock); [ 86.545154] lock(&dsq->lock); [ 86.552680] lock(rhashtable_bucket); [ 86.558244] *** DEADLOCK *** Fix by avoiding the acquisition of the rhashtable lock while dsq->lock is held in destroy_dsq(). Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class") Signed-off-by: Andrea Righi --- kernel/sched/ext.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c index 8535b46fa4c3..f1bc7639e730 100644 --- a/kernel/sched/ext.c +++ b/kernel/sched/ext.c @@ -4521,9 +4521,6 @@ static void destroy_dsq(u64 dsq_id) goto out_unlock_dsq; } =20 - if (rhashtable_remove_fast(&dsq_hash, &dsq->hash_node, dsq_hash_params)) - goto out_unlock_dsq; - /* * Mark dead by invalidating ->id to prevent dispatch_enqueue() from * queueing more tasks. As this function can be called from anywhere, @@ -4531,6 +4528,19 @@ static void destroy_dsq(u64 dsq_id) * operations inside scheduler locks. */ dsq->id =3D SCX_DSQ_INVALID; + + raw_spin_unlock_irqrestore(&dsq->lock, flags); + + /* + * If removing the DSQ from the rhashtable fails, it means that a + * concurrent destroy_dsq() has already removed it. In this case, + * avoid triggering the free via the irq work. + */ + if (rhashtable_remove_fast(&dsq_hash, &dsq->hash_node, dsq_hash_params)) + goto out_unlock_rcu; + + raw_spin_lock_irqsave(&dsq->lock, flags); + llist_add(&dsq->free_node, &dsqs_to_free); irq_work_queue(&free_dsq_irq_work); =20 --=20 2.48.0