mbox series

[4.4,0/3] Backport patch series to update Futex from 4.9

Message ID 20210309030605.3295183-1-zhengyejian1@huawei.com
Headers show
Series Backport patch series to update Futex from 4.9 | expand

Message

Zheng Yejian March 9, 2021, 3:06 a.m. UTC
Lee sent a patchset to update Futex for 4.9, see https://www.spinics.net/lists/stable/msg443081.html,
Then Xiaoming sent a follow-up patch for it, see https://lore.kernel.org/lkml/20210225093120.GD641347@dell/.

These patchsets may also resolve following issues in 4.4.260 which have been reported in 4.9,
see https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/?h=linux-4.4.y&id=319f66f08de1083c1fe271261665c209009dd65a
      > /*
      >  * The task is on the way out. When the futex state is
      >  * FUTEX_STATE_DEAD, we know that the task has finished
      >  * the cleanup:
      >  */
      > int ret = (p->futex_state = FUTEX_STATE_DEAD) ? -ESRCH : -EAGAIN;

    Here may be:
      int ret = (p->futex_state == FUTEX_STATE_DEAD) ? -ESRCH : -EAGAIN;

      > raw_spin_unlock_irq(&p->pi_lock);
      > /*
      >  * If the owner task is between FUTEX_STATE_EXITING and
      >  * FUTEX_STATE_DEAD then store the task pointer and keep
      >  * the reference on the task struct. The calling code will
      >  * drop all locks, wait for the task to reach
      >  * FUTEX_STATE_DEAD and then drop the refcount. This is
      >  * required to prevent a live lock when the current task
      >  * preempted the exiting task between the two states.
      >  */
      > if (ret == -EBUSY)

    And here, the variable "ret" may only be "-ESRCH" or "-EAGAIN", but not "-EBUSY".

      > 	*exiting = p;
      > else
      > 	put_task_struct(p);

Since 074e7d515783 ("futex: Ensure the correct return value from futex_lock_pi()") has
been merged in 4.4.260, I send the remain 3 patches.

Peter Zijlstra (1):
  futex: Change locking rules

Thomas Gleixner (2):
  futex: Cure exit race
  futex: fix dead code in attach_to_pi_owner()

 kernel/futex.c | 209 +++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 177 insertions(+), 32 deletions(-)

Comments

Greg KH March 9, 2021, 10:40 a.m. UTC | #1
On Tue, Mar 09, 2021 at 11:06:05AM +0800, Zheng Yejian wrote:
> From: Thomas Gleixner <tglx@linutronix.de>
> 
> The handle_exit_race() function is defined in commit 9c3f39860367
>  ("futex: Cure exit race"), which never returns -EBUSY. This results
> in a small piece of dead code in the attach_to_pi_owner() function:
> 
> 	int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */
> 	...
> 	if (ret == -EBUSY)
> 		*exiting = p; /* dead code */
> 
> The return value -EBUSY is added to handle_exit_race() in upsteam
> commit ac31c7ff8624409 ("futex: Provide distinct return value when
> owner is exiting"). This commit was incorporated into v4.9.255, before
> the function handle_exit_race() was introduced, whitout Modify
> handle_exit_race().
> 
> To fix dead code, extract the change of handle_exit_race() from
> commit ac31c7ff8624409 ("futex: Provide distinct return value when owner
>  is exiting"), re-incorporated.
> 
> Lee writes:
> 
> This commit takes the remaining functional snippet of:
> 
>  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")
> 
> ... and is the correct fix for this issue.
> 
> Fixes: 9c3f39860367 ("futex: Cure exit race")
> Cc: stable@vger.kernel.org # v4.9.258
> Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
> Reviewed-by: Lee Jones <lee.jones@linaro.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
> ---
>  kernel/futex.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)

Same here, what is the upstream git id?

thanks,

greg k-h
Lee Jones March 9, 2021, 6:14 p.m. UTC | #2
On Tue, 09 Mar 2021, Greg KH wrote:

> On Tue, Mar 09, 2021 at 11:06:05AM +0800, Zheng Yejian wrote:
> > From: Thomas Gleixner <tglx@linutronix.de>
> > 
> > The handle_exit_race() function is defined in commit 9c3f39860367
> >  ("futex: Cure exit race"), which never returns -EBUSY. This results
> > in a small piece of dead code in the attach_to_pi_owner() function:
> > 
> > 	int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */
> > 	...
> > 	if (ret == -EBUSY)
> > 		*exiting = p; /* dead code */
> > 
> > The return value -EBUSY is added to handle_exit_race() in upsteam
> > commit ac31c7ff8624409 ("futex: Provide distinct return value when
> > owner is exiting"). This commit was incorporated into v4.9.255, before
> > the function handle_exit_race() was introduced, whitout Modify
> > handle_exit_race().
> > 
> > To fix dead code, extract the change of handle_exit_race() from
> > commit ac31c7ff8624409 ("futex: Provide distinct return value when owner
> >  is exiting"), re-incorporated.
> > 
> > Lee writes:
> > 
> > This commit takes the remaining functional snippet of:
> > 
> >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")
> > 
> > ... and is the correct fix for this issue.
> > 
> > Fixes: 9c3f39860367 ("futex: Cure exit race")
> > Cc: stable@vger.kernel.org # v4.9.258
> > Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
> > Reviewed-by: Lee Jones <lee.jones@linaro.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
> > ---
> >  kernel/futex.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> Same here, what is the upstream git id?

It doesn't have one as such - it's a part-patch:

> > This commit takes the remaining functional snippet of:
> > 
> >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")
Greg KH March 10, 2021, noon UTC | #3
On Tue, Mar 09, 2021 at 06:14:37PM +0000, Lee Jones wrote:
> On Tue, 09 Mar 2021, Greg KH wrote:

> 

> > On Tue, Mar 09, 2021 at 11:06:05AM +0800, Zheng Yejian wrote:

> > > From: Thomas Gleixner <tglx@linutronix.de>

> > > 

> > > The handle_exit_race() function is defined in commit 9c3f39860367

> > >  ("futex: Cure exit race"), which never returns -EBUSY. This results

> > > in a small piece of dead code in the attach_to_pi_owner() function:

> > > 

> > > 	int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */

> > > 	...

> > > 	if (ret == -EBUSY)

> > > 		*exiting = p; /* dead code */

> > > 

> > > The return value -EBUSY is added to handle_exit_race() in upsteam

> > > commit ac31c7ff8624409 ("futex: Provide distinct return value when

> > > owner is exiting"). This commit was incorporated into v4.9.255, before

> > > the function handle_exit_race() was introduced, whitout Modify

> > > handle_exit_race().

> > > 

> > > To fix dead code, extract the change of handle_exit_race() from

> > > commit ac31c7ff8624409 ("futex: Provide distinct return value when owner

> > >  is exiting"), re-incorporated.

> > > 

> > > Lee writes:

> > > 

> > > This commit takes the remaining functional snippet of:

> > > 

> > >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

> > > 

> > > ... and is the correct fix for this issue.

> > > 

> > > Fixes: 9c3f39860367 ("futex: Cure exit race")

> > > Cc: stable@vger.kernel.org # v4.9.258

> > > Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>

> > > Reviewed-by: Lee Jones <lee.jones@linaro.org>

> > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

> > > Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>

> > > ---

> > >  kernel/futex.c | 6 +++---

> > >  1 file changed, 3 insertions(+), 3 deletions(-)

> > 

> > Same here, what is the upstream git id?

> 

> It doesn't have one as such - it's a part-patch:

> 

> > > This commit takes the remaining functional snippet of:

> > > 

> > >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")


That wasn't obvious :(

Is this a backport of another patch in the stable tree somewhere?

confused,

greg k-h
Lee Jones March 10, 2021, 1:28 p.m. UTC | #4
On Wed, 10 Mar 2021, Greg KH wrote:

> On Tue, Mar 09, 2021 at 06:14:37PM +0000, Lee Jones wrote:

> > On Tue, 09 Mar 2021, Greg KH wrote:

> > 

> > > On Tue, Mar 09, 2021 at 11:06:05AM +0800, Zheng Yejian wrote:

> > > > From: Thomas Gleixner <tglx@linutronix.de>

> > > > 

> > > > The handle_exit_race() function is defined in commit 9c3f39860367

> > > >  ("futex: Cure exit race"), which never returns -EBUSY. This results

> > > > in a small piece of dead code in the attach_to_pi_owner() function:

> > > > 

> > > > 	int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */

> > > > 	...

> > > > 	if (ret == -EBUSY)

> > > > 		*exiting = p; /* dead code */

> > > > 

> > > > The return value -EBUSY is added to handle_exit_race() in upsteam

> > > > commit ac31c7ff8624409 ("futex: Provide distinct return value when

> > > > owner is exiting"). This commit was incorporated into v4.9.255, before

> > > > the function handle_exit_race() was introduced, whitout Modify

> > > > handle_exit_race().

> > > > 

> > > > To fix dead code, extract the change of handle_exit_race() from

> > > > commit ac31c7ff8624409 ("futex: Provide distinct return value when owner

> > > >  is exiting"), re-incorporated.

> > > > 

> > > > Lee writes:

> > > > 

> > > > This commit takes the remaining functional snippet of:

> > > > 

> > > >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

> > > > 

> > > > ... and is the correct fix for this issue.

> > > > 

> > > > Fixes: 9c3f39860367 ("futex: Cure exit race")

> > > > Cc: stable@vger.kernel.org # v4.9.258

> > > > Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>

> > > > Reviewed-by: Lee Jones <lee.jones@linaro.org>

> > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

> > > > Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>

> > > > ---

> > > >  kernel/futex.c | 6 +++---

> > > >  1 file changed, 3 insertions(+), 3 deletions(-)

> > > 

> > > Same here, what is the upstream git id?

> > 

> > It doesn't have one as such - it's a part-patch:

> > 

> > > > This commit takes the remaining functional snippet of:

> > > > 

> > > >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

> 

> That wasn't obvious :(


This was also my thinking, which is why I replied to the original
patch in an attempt to clarify what I thought was happening.

> Is this a backport of another patch in the stable tree somewhere?


Yes, it looks like it.

The full patch was back-ported to v4.14 as:

  e6e00df182908f34360c3c9f2d13cc719362e9c0

-- 
Lee Jones [李琼斯]
Senior Technical Lead - Developer Services
Linaro.org │ Open source software for Arm SoCs
Follow Linaro: Facebook | Twitter | Blog
Greg KH March 10, 2021, 2:10 p.m. UTC | #5
On Wed, Mar 10, 2021 at 01:28:02PM +0000, Lee Jones wrote:
> On Wed, 10 Mar 2021, Greg KH wrote:

> 

> > On Tue, Mar 09, 2021 at 06:14:37PM +0000, Lee Jones wrote:

> > > On Tue, 09 Mar 2021, Greg KH wrote:

> > > 

> > > > On Tue, Mar 09, 2021 at 11:06:05AM +0800, Zheng Yejian wrote:

> > > > > From: Thomas Gleixner <tglx@linutronix.de>

> > > > > 

> > > > > The handle_exit_race() function is defined in commit 9c3f39860367

> > > > >  ("futex: Cure exit race"), which never returns -EBUSY. This results

> > > > > in a small piece of dead code in the attach_to_pi_owner() function:

> > > > > 

> > > > > 	int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */

> > > > > 	...

> > > > > 	if (ret == -EBUSY)

> > > > > 		*exiting = p; /* dead code */

> > > > > 

> > > > > The return value -EBUSY is added to handle_exit_race() in upsteam

> > > > > commit ac31c7ff8624409 ("futex: Provide distinct return value when

> > > > > owner is exiting"). This commit was incorporated into v4.9.255, before

> > > > > the function handle_exit_race() was introduced, whitout Modify

> > > > > handle_exit_race().

> > > > > 

> > > > > To fix dead code, extract the change of handle_exit_race() from

> > > > > commit ac31c7ff8624409 ("futex: Provide distinct return value when owner

> > > > >  is exiting"), re-incorporated.

> > > > > 

> > > > > Lee writes:

> > > > > 

> > > > > This commit takes the remaining functional snippet of:

> > > > > 

> > > > >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

> > > > > 

> > > > > ... and is the correct fix for this issue.

> > > > > 

> > > > > Fixes: 9c3f39860367 ("futex: Cure exit race")

> > > > > Cc: stable@vger.kernel.org # v4.9.258

> > > > > Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>

> > > > > Reviewed-by: Lee Jones <lee.jones@linaro.org>

> > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

> > > > > Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>

> > > > > ---

> > > > >  kernel/futex.c | 6 +++---

> > > > >  1 file changed, 3 insertions(+), 3 deletions(-)

> > > > 

> > > > Same here, what is the upstream git id?

> > > 

> > > It doesn't have one as such - it's a part-patch:

> > > 

> > > > > This commit takes the remaining functional snippet of:

> > > > > 

> > > > >  ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

> > 

> > That wasn't obvious :(

> 

> This was also my thinking, which is why I replied to the original

> patch in an attempt to clarify what I thought was happening.

> 

> > Is this a backport of another patch in the stable tree somewhere?

> 

> Yes, it looks like it.

> 

> The full patch was back-ported to v4.14 as:

> 

>   e6e00df182908f34360c3c9f2d13cc719362e9c0


Ok, Zheng, can you put this information in the patch and resend the
whole series?

thanks,

greg k-h
Zheng Yejian March 11, 2021, 1:39 a.m. UTC | #6
On 2021/3/10 22:10, Greg KH wrote:
> On Wed, Mar 10, 2021 at 01:28:02PM +0000, Lee Jones wrote:

>> On Wed, 10 Mar 2021, Greg KH wrote:

>>

>>> On Tue, Mar 09, 2021 at 06:14:37PM +0000, Lee Jones wrote:

>>>> On Tue, 09 Mar 2021, Greg KH wrote:

>>>>

>>>>> On Tue, Mar 09, 2021 at 11:06:05AM +0800, Zheng Yejian wrote:

>>>>>> From: Thomas Gleixner <tglx@linutronix.de>

>>>>>>

>>>>>> The handle_exit_race() function is defined in commit 9c3f39860367

>>>>>>   ("futex: Cure exit race"), which never returns -EBUSY. This results

>>>>>> in a small piece of dead code in the attach_to_pi_owner() function:

>>>>>>

>>>>>> 	int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */

>>>>>> 	...

>>>>>> 	if (ret == -EBUSY)

>>>>>> 		*exiting = p; /* dead code */

>>>>>>

>>>>>> The return value -EBUSY is added to handle_exit_race() in upsteam

>>>>>> commit ac31c7ff8624409 ("futex: Provide distinct return value when

>>>>>> owner is exiting"). This commit was incorporated into v4.9.255, before

>>>>>> the function handle_exit_race() was introduced, whitout Modify

>>>>>> handle_exit_race().

>>>>>>

>>>>>> To fix dead code, extract the change of handle_exit_race() from

>>>>>> commit ac31c7ff8624409 ("futex: Provide distinct return value when owner

>>>>>>   is exiting"), re-incorporated.

>>>>>>

>>>>>> Lee writes:

>>>>>>

>>>>>> This commit takes the remaining functional snippet of:

>>>>>>

>>>>>>   ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

>>>>>>

>>>>>> ... and is the correct fix for this issue.

>>>>>>

>>>>>> Fixes: 9c3f39860367 ("futex: Cure exit race")

>>>>>> Cc: stable@vger.kernel.org # v4.9.258

>>>>>> Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>

>>>>>> Reviewed-by: Lee Jones <lee.jones@linaro.org>

>>>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

>>>>>> Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>

>>>>>> ---

>>>>>>   kernel/futex.c | 6 +++---

>>>>>>   1 file changed, 3 insertions(+), 3 deletions(-)

>>>>>

>>>>> Same here, what is the upstream git id?

>>>>

>>>> It doesn't have one as such - it's a part-patch:

>>>>

>>>>>> This commit takes the remaining functional snippet of:

>>>>>>

>>>>>>   ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

>>>

>>> That wasn't obvious :(

>>

>> This was also my thinking, which is why I replied to the original

>> patch in an attempt to clarify what I thought was happening.

>>

>>> Is this a backport of another patch in the stable tree somewhere?

>>

>> Yes, it looks like it.

>>

>> The full patch was back-ported to v4.14 as:

>>

>>    e6e00df182908f34360c3c9f2d13cc719362e9c0

> 

> Ok, Zheng, can you put this information in the patch and resend the

> whole series?

> 


Sure, I'll send a "v2" patchset soon.
Thanks for your suggestions,

Zheng Yejian
Zheng Yejian March 11, 2021, 3:48 a.m. UTC | #7
On 2021/3/9 18:41, Greg KH wrote:
> On Tue, Mar 09, 2021 at 11:06:02AM +0800, Zheng Yejian wrote:

>> Lee sent a patchset to update Futex for 4.9, see https://www.spinics.net/lists/stable/msg443081.html,

>> Then Xiaoming sent a follow-up patch for it, see https://lore.kernel.org/lkml/20210225093120.GD641347@dell/.

>>

>> These patchsets may also resolve following issues in 4.4.260 which have been reported in 4.9,

>> see https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/?h=linux-4.4.y&id=319f66f08de1083c1fe271261665c209009dd65a

>>        > /*

>>        >  * The task is on the way out. When the futex state is

>>        >  * FUTEX_STATE_DEAD, we know that the task has finished

>>        >  * the cleanup:

>>        >  */

>>        > int ret = (p->futex_state = FUTEX_STATE_DEAD) ? -ESRCH : -EAGAIN;

>>

>>      Here may be:

>>        int ret = (p->futex_state == FUTEX_STATE_DEAD) ? -ESRCH : -EAGAIN;

>>

>>        > raw_spin_unlock_irq(&p->pi_lock);

>>        > /*

>>        >  * If the owner task is between FUTEX_STATE_EXITING and

>>        >  * FUTEX_STATE_DEAD then store the task pointer and keep

>>        >  * the reference on the task struct. The calling code will

>>        >  * drop all locks, wait for the task to reach

>>        >  * FUTEX_STATE_DEAD and then drop the refcount. This is

>>        >  * required to prevent a live lock when the current task

>>        >  * preempted the exiting task between the two states.

>>        >  */

>>        > if (ret == -EBUSY)

>>

>>      And here, the variable "ret" may only be "-ESRCH" or "-EAGAIN", but not "-EBUSY".

>>

>>        > 	*exiting = p;

>>        > else

>>        > 	put_task_struct(p);

>>

>> Since 074e7d515783 ("futex: Ensure the correct return value from futex_lock_pi()") has

>> been merged in 4.4.260, I send the remain 3 patches.

> 

> There already are 2 futex patches in the 4.4.y stable queue, do those

> not resolve these issues for you?


I think that 2 futex patches in 4.4 stable queue are fixing other issues:
     futex-fix-irq-self-deadlock-and-satisfy-assertion.patch
     futex-fix-spin_lock-spin_unlock_irq-imbalance.patch
But I am not very sure if there are any lock conflicts between that 2 
patches and this 3 patches.

> 

> If not, please resend this series with the needed git commit ids added to

> them.


I have add that information and sent a "v2" patchset.