mainline inclusion from mainline-v6.6-rc1 commit d256d1cd8da1cbc4615de69df71c87ce623fec2f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I85WL9 CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

We found a softlock issue in our test, analyzed the logs, and found that the relevant CPU call trace as follows:

CPU0: _do_fork -> copy_process() -> write_lock_irq(&tasklist_lock) //Disable irq,waiting for //tasklist_lock

CPU1: wp_page_copy() ->pte_offset_map_lock() -> spin_lock(&page->ptl); //Hold page->ptl -> ptep_clear_flush() -> flush_tlb_others() ... -> smp_call_function_many() -> arch_send_call_function_ipi_mask() -> csd_lock_wait() //Waiting for other CPUs respond //IPI

CPU2: collect_procs_anon() -> read_lock(&tasklist_lock) //Hold tasklist_lock ->for_each_process(tsk) -> page_mapped_in_vma() -> page_vma_mapped_walk() -> map_pte() ->spin_lock(&page->ptl) //Waiting for page->ptl

We can see that CPU1 waiting for CPU0 respond IPI，CPU0 waiting for CPU2 unlock tasklist_lock, CPU2 waiting for CPU1 unlock page->ptl. As a result, softlockup is triggered.

For collect_procs_anon(), what we're doing is task list iteration, during the iteration, with the help of call_rcu(), the task_struct object is freed only after one or more grace periods elapse. the logic as follows:

release_task() -> __exit_signal() -> __unhash_process() -> list_del_rcu()

-> put_task_struct_rcu_user() -> call_rcu(&task->rcu, delayed_put_task_struct)

delayed_put_task_struct() -> put_task_struct() -> if (refcount_sub_and_test()) __put_task_struct() -> free_task()

Therefore, under the protection of the rcu lock, we can safely use get_task_struct() to ensure a safe reference to task_struct during the iteration.

By removing the use of tasklist_lock in task list iteration, we can break the softlock chain above.

The same logic can also be applied to: - collect_procs_file() - collect_procs_fsdax() - collect_procs_ksm()

Link: https://lkml.kernel.org/r/20230828022527.241693-1-tongtiangen@huawei.com Signed-off-by: Tong Tiangen tongtiangen@huawei.com Acked-by: Naoya Horiguchi naoya.horiguchi@nec.com Cc: Kefeng Wang wangkefeng.wang@huawei.com Cc: Matthew Wilcox (Oracle) willy@infradead.org Cc: Miaohe Lin linmiaohe@huawei.com Cc: Paul E. McKenney paulmck@kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org

Conflicts: mm/filemap.c mm/ksm.c mm/memory-failure.c

Signed-off-by: Tong Tiangen tongtiangen@huawei.com --- mm/filemap.c | 3 --- mm/memory-failure.c | 12 ++++++------ 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/mm/filemap.c b/mm/filemap.c index f33504b784a2..5bf4645256cb 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -166,9 +166,6 @@ static void page_cache_kill(struct page *page) * bdi.wb->list_lock (zap_pte_range->set_page_dirty) * ->inode->i_lock (zap_pte_range->set_page_dirty) * ->private_lock (zap_pte_range->__set_page_dirty_buffers) - * - * ->i_mmap_rwsem - * ->tasklist_lock (memory_failure, collect_procs_ao) */

static int page_cache_tree_insert(struct address_space *mapping, diff --git a/mm/memory-failure.c b/mm/memory-failure.c index fff715a27253..8924d7d9bffa 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -427,8 +427,8 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail, * on behalf of the thread group. Return task_struct of the (first found) * dedicated thread if found, and return NULL otherwise. * - * We already hold read_lock(&tasklist_lock) in the caller, so we don't - * have to call rcu_read_lock/unlock() in this function. + * We already hold rcu lock in the caller, so we don't have to call + * rcu_read_lock/unlock() in this function. */ static struct task_struct *find_early_kill_thread(struct task_struct *tsk) { @@ -478,7 +478,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, return;

pgoff = page_to_pgoff(page); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process (tsk) { struct anon_vma_chain *vmac; struct task_struct *t = task_early_kill(tsk, force_early); @@ -494,7 +494,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, add_to_kill(t, page, vma, to_kill, tkc); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); page_unlock_anon_vma_read(av); }

@@ -509,7 +509,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, struct address_space *mapping = page->mapping;

i_mmap_lock_read(mapping); - read_lock(&tasklist_lock); + rcu_read_lock(); for_each_process(tsk) { pgoff_t pgoff = page_to_pgoff(page); struct task_struct *t = task_early_kill(tsk, force_early); @@ -529,7 +529,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, add_to_kill(t, page, vma, to_kill, tkc); } } - read_unlock(&tasklist_lock); + rcu_read_unlock(); i_mmap_unlock_read(mapping); }