releases/4.14.24/cgroup-fix-deadlock-in-cpu-hotplug-path.patch

   1 From foo@baz Wed Feb 28 16:23:28 CET 2018
   2 From: Prateek Sood <prsood@codeaurora.org>
   3 Date: Tue, 19 Dec 2017 12:56:57 +0530
   4 Subject: cgroup: Fix deadlock in cpu hotplug path
   5
   6 From: Prateek Sood <prsood@codeaurora.org>
   7
   8
   9 [ Upstream commit 116d2f7496c51b2e02e8e4ecdd2bdf5fb9d5a641 ]
  10
  11 Deadlock during cgroup migration from cpu hotplug path when a task T is
  12 being moved from source to destination cgroup.
  13
  14 kworker/0:0
  15 cpuset_hotplug_workfn()
  16    cpuset_hotplug_update_tasks()
  17       hotplug_update_tasks_legacy()
  18         remove_tasks_in_empty_cpuset()
  19           cgroup_transfer_tasks() // stuck in iterator loop
  20             cgroup_migrate()
  21               cgroup_migrate_add_task()
  22
  23 In cgroup_migrate_add_task() it checks for PF_EXITING flag of task T.
  24 Task T will not migrate to destination cgroup. css_task_iter_start()
  25 will keep pointing to task T in loop waiting for task T cg_list node
  26 to be removed.
  27
  28 Task T
  29 do_exit()
  30   exit_signals() // sets PF_EXITING
  31   exit_task_namespaces()
  32     switch_task_namespaces()
  33       free_nsproxy()
  34         put_mnt_ns()
  35           drop_collected_mounts()
  36             namespace_unlock()
  37               synchronize_rcu()
  38                 _synchronize_rcu_expedited()
  39                   schedule_work() // on cpu0 low priority worker pool
  40                   wait_event() // waiting for work item to execute
  41
  42 Task T inserted a work item in the worklist of cpu0 low priority
  43 worker pool. It is waiting for expedited grace period work item
  44 to execute. This work item will only be executed once kworker/0:0
  45 complete execution of cpuset_hotplug_workfn().
  46
  47 kworker/0:0 ==> Task T ==>kworker/0:0
  48
  49 In case of PF_EXITING task being migrated from source to destination
  50 cgroup, migrate next available task in source cgroup.
  51
  52 Signed-off-by: Prateek Sood <prsood@codeaurora.org>
  53 Signed-off-by: Tejun Heo <tj@kernel.org>
  54 Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
  55 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  56 ---
  57  kernel/cgroup/cgroup-v1.c |    6 +++++-
  58  1 file changed, 5 insertions(+), 1 deletion(-)
  59
  60 --- a/kernel/cgroup/cgroup-v1.c
  61 +++ b/kernel/cgroup/cgroup-v1.c
  62 @@ -123,7 +123,11 @@ int cgroup_transfer_tasks(struct cgroup
  63          */
  64         do {
  65                 css_task_iter_start(&from->self, 0, &it);
  66 -               task = css_task_iter_next(&it);
  67 +
  68 +               do {
  69 +                       task = css_task_iter_next(&it);
  70 +               } while (task && (task->flags & PF_EXITING));
  71 +
  72                 if (task)
  73                         get_task_struct(task);
  74                 css_task_iter_end(&it);