lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 169/191] sched/core: Fix PI boosting between RT and DEADLINE tasks
    Date
    From: Juri Lelli <juri.lelli@redhat.com>

    [ Upstream commit 740797ce3a124b7dd22b7fb832d87bc8fba1cf6f ]

    syzbot reported the following warning:

    WARNING: CPU: 1 PID: 6351 at kernel/sched/deadline.c:628
    enqueue_task_dl+0x22da/0x38a0 kernel/sched/deadline.c:1504

    At deadline.c:628 we have:

    623 static inline void setup_new_dl_entity(struct sched_dl_entity *dl_se)
    624 {
    625 struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
    626 struct rq *rq = rq_of_dl_rq(dl_rq);
    627
    628 WARN_ON(dl_se->dl_boosted);
    629 WARN_ON(dl_time_before(rq_clock(rq), dl_se->deadline));
    [...]
    }

    Which means that setup_new_dl_entity() has been called on a task
    currently boosted. This shouldn't happen though, as setup_new_dl_entity()
    is only called when the 'dynamic' deadline of the new entity
    is in the past w.r.t. rq_clock and boosted tasks shouldn't verify this
    condition.

    Digging through the PI code I noticed that what above might in fact happen
    if an RT tasks blocks on an rt_mutex hold by a DEADLINE task. In the
    first branch of boosting conditions we check only if a pi_task 'dynamic'
    deadline is earlier than mutex holder's and in this case we set mutex
    holder to be dl_boosted. However, since RT 'dynamic' deadlines are only
    initialized if such tasks get boosted at some point (or if they become
    DEADLINE of course), in general RT 'dynamic' deadlines are usually equal
    to 0 and this verifies the aforementioned condition.

    Fix it by checking that the potential donor task is actually (even if
    temporary because in turn boosted) running at DEADLINE priority before
    using its 'dynamic' deadline value.

    Fixes: 2d3d891d3344 ("sched/deadline: Add SCHED_DEADLINE inheritance logic")
    Reported-by: syzbot+119ba87189432ead09b4@syzkaller.appspotmail.com
    Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
    Tested-by: Daniel Wagner <dwagner@suse.de>
    Link: https://lkml.kernel.org/r/20181119153201.GB2119@localhost.localdomain
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/sched/core.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/kernel/sched/core.c b/kernel/sched/core.c
    index 82cec9a666e7b..870d802c46f90 100644
    --- a/kernel/sched/core.c
    +++ b/kernel/sched/core.c
    @@ -3697,7 +3697,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
    if (dl_prio(prio)) {
    struct task_struct *pi_task = rt_mutex_get_top_task(p);
    if (!dl_prio(p->normal_prio) ||
    - (pi_task && dl_entity_preempt(&pi_task->dl, &p->dl))) {
    + (pi_task && dl_prio(pi_task->prio) &&
    + dl_entity_preempt(&pi_task->dl, &p->dl))) {
    p->dl.dl_boosted = 1;
    queue_flag |= ENQUEUE_REPLENISH;
    } else
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-29 22:39    [W:4.039 / U:0.532 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site