{"push_id":1426449460,"size":13,"distinct_size":13,"ref":"refs/heads/release","head":"c55c1f4565a008ddb9f6857385ca7b574a3246c4","before":"c922eb405f7b69646be3a5d78e008f32cc04a18e","commits":[{"sha":"accea947650f8497894d042bdbdbd63033758f53","author":{"name":"Ingo Molnar","email":"90e4d1e8f219066a3d31774bfa42a254ac6b5b82@elte.hu"},"message":"core: Do not disable interrupts on RT in res_counter.c\n\nFrederic Weisbecker reported this warning:\n\n[   45.228562] BUG: sleeping function called from invalid context at kernel/rtmutex.c:683\n[   45.228571] in_atomic(): 0, irqs_disabled(): 1, pid: 4290, name: ntpdate\n[   45.228576] INFO: lockdep is turned off.\n[   45.228580] irq event stamp: 0\n[   45.228583] hardirqs last  enabled at (0): [<(null)>] (null)\n[   45.228589] hardirqs last disabled at (0): [<ffffffff8025449d>] copy_process+0x68d/0x1500\n[   45.228602] softirqs last  enabled at (0): [<ffffffff8025449d>] copy_process+0x68d/0x1500\n[   45.228609] softirqs last disabled at (0): [<(null)>] (null)\n[   45.228617] Pid: 4290, comm: ntpdate Tainted: G        W  2.6.29-rc4-rt1-tip #1\n[   45.228622] Call Trace:\n[   45.228632]  [<ffffffff8027dfb0>] ? print_irqtrace_events+0xd0/0xe0\n[   45.228639]  [<ffffffff8024cd73>] __might_sleep+0x113/0x130\n[   45.228646]  [<ffffffff8077c811>] rt_spin_lock+0xa1/0xb0\n[   45.228653]  [<ffffffff80296a3d>] res_counter_charge+0x5d/0x130\n[   45.228660]  [<ffffffff802fb67f>] __mem_cgroup_try_charge+0x7f/0x180\n[   45.228667]  [<ffffffff802fc407>] mem_cgroup_charge_common+0x57/0x90\n[   45.228674]  [<ffffffff80212096>] ? ftrace_call+0x5/0x2b\n[   45.228680]  [<ffffffff802fc49d>] mem_cgroup_newpage_charge+0x5d/0x60\n[   45.228688]  [<ffffffff802d94ce>] __do_fault+0x29e/0x4c0\n[   45.228694]  [<ffffffff8077c843>] ? rt_spin_unlock+0x23/0x80\n[   45.228700]  [<ffffffff802db8b5>] handle_mm_fault+0x205/0x890\n[   45.228707]  [<ffffffff80212096>] ? ftrace_call+0x5/0x2b\n[   45.228714]  [<ffffffff8023495e>] do_page_fault+0x11e/0x2a0\n[   45.228720]  [<ffffffff8077e5a5>] page_fault+0x25/0x30\n[   45.228727]  [<ffffffff8043e1ed>] ? __clear_user+0x3d/0x70\n[   45.228733]  [<ffffffff8043e1d1>] ? __clear_user+0x21/0x70\n\nThe reason is the raw IRQ flag use of kernel/res_counter.c.\n\nThe irq flags tricks there seem a bit pointless: it cannot protect the\nc->parent linkage because local_irq_save() is only per CPU.\n\nSo replace it with _nort(). This code needs a second look.\n\nReported-by: Frederic Weisbecker <fweisbec@gmail.com>\nSigned-off-by: Ingo Molnar <mingo@elte.hu>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/accea947650f8497894d042bdbdbd63033758f53"},{"sha":"2cfe8ffb71918df15e3e584e39e3357c0138a43e","author":{"name":"Mike Galbraith","email":"a08f7b1662c31b8f0ac790026027c02e6e42bccf@gmail.com"},"message":"scheduling while atomic in cgroup code\n\nmm, memcg: make refill_stock() use get_cpu_light()\n\nNikita reported the following memcg scheduling while atomic bug:\n\nCall Trace:\n[e22d5a90] [c0007ea8] show_stack+0x4c/0x168 (unreliable)\n[e22d5ad0] [c0618c04] __schedule_bug+0x94/0xb0\n[e22d5ae0] [c060b9ec] __schedule+0x530/0x550\n[e22d5bf0] [c060bacc] schedule+0x30/0xbc\n[e22d5c00] [c060ca24] rt_spin_lock_slowlock+0x180/0x27c\n[e22d5c70] [c00b39dc] res_counter_uncharge_until+0x40/0xc4\n[e22d5ca0] [c013ca88] drain_stock.isra.20+0x54/0x98\n[e22d5cc0] [c01402ac] __mem_cgroup_try_charge+0x2e8/0xbac\n[e22d5d70] [c01410d4] mem_cgroup_charge_common+0x3c/0x70\n[e22d5d90] [c0117284] __do_fault+0x38c/0x510\n[e22d5df0] [c011a5f4] handle_pte_fault+0x98/0x858\n[e22d5e50] [c060ed08] do_page_fault+0x42c/0x6fc\n[e22d5f40] [c000f5b4] handle_page_fault+0xc/0x80\n\nWhat happens:\n\n   refill_stock()\n      get_cpu_var()\n      drain_stock()\n         res_counter_uncharge()\n            res_counter_uncharge_until()\n               spin_lock() <== boom\n\nFix it by replacing get/put_cpu_var() with get/put_cpu_light().\n\nCc: stable-rt@vger.kernel.org\nReported-by: Nikita Yushchenko <nyushchenko@dev.rtsoft.ru>\nSigned-off-by: Mike Galbraith <umgwanakikbuti@gmail.com>\nSigned-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/2cfe8ffb71918df15e3e584e39e3357c0138a43e"},{"sha":"fd8b90b6a2f7e062174b907c0b51fa9b69229484","author":{"name":"Michal Hocko","email":"549a3b539eb67715c6526d830d82ed0bec455278@suse.cz"},"message":"mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations\n\n[ Upstream commit ecf5fc6e9654cd7a268c782a523f072b2f1959f9 ]\n\nNikolay has reported a hang when a memcg reclaim got stuck with the\nfollowing backtrace:\n\nPID: 18308  TASK: ffff883d7c9b0a30  CPU: 1   COMMAND: \"rsync\"\n  #0 __schedule at ffffffff815ab152\n  #1 schedule at ffffffff815ab76e\n  #2 schedule_timeout at ffffffff815ae5e5\n  #3 io_schedule_timeout at ffffffff815aad6a\n  #4 bit_wait_io at ffffffff815abfc6\n  #5 __wait_on_bit at ffffffff815abda5\n  #6 wait_on_page_bit at ffffffff8111fd4f\n  #7 shrink_page_list at ffffffff81135445\n  #8 shrink_inactive_list at ffffffff81135845\n  #9 shrink_lruvec at ffffffff81135ead\n #10 shrink_zone at ffffffff811360c3\n #11 shrink_zones at ffffffff81136eff\n #12 do_try_to_free_pages at ffffffff8113712f\n #13 try_to_free_mem_cgroup_pages at ffffffff811372be\n #14 try_charge at ffffffff81189423\n #15 mem_cgroup_try_charge at ffffffff8118c6f5\n #16 __add_to_page_cache_locked at ffffffff8112137d\n #17 add_to_page_cache_lru at ffffffff81121618\n #18 pagecache_get_page at ffffffff8112170b\n #19 grow_dev_page at ffffffff811c8297\n #20 __getblk_slow at ffffffff811c91d6\n #21 __getblk_gfp at ffffffff811c92c1\n #22 ext4_ext_grow_indepth at ffffffff8124565c\n #23 ext4_ext_create_new_leaf at ffffffff81246ca8\n #24 ext4_ext_insert_extent at ffffffff81246f09\n #25 ext4_ext_map_blocks at ffffffff8124a848\n #26 ext4_map_blocks at ffffffff8121a5b7\n #27 mpage_map_one_extent at ffffffff8121b1fa\n #28 mpage_map_and_submit_extent at ffffffff8121f07b\n #29 ext4_writepages at ffffffff8121f6d5\n #30 do_writepages at ffffffff8112c490\n #31 __filemap_fdatawrite_range at ffffffff81120199\n #32 filemap_flush at ffffffff8112041c\n #33 ext4_alloc_da_blocks at ffffffff81219da1\n #34 ext4_rename at ffffffff81229b91\n #35 ext4_rename2 at ffffffff81229e32\n #36 vfs_rename at ffffffff811a08a5\n #37 SYSC_renameat2 at ffffffff811a3ffc\n #38 sys_renameat2 at ffffffff811a408e\n #39 sys_rename at ffffffff8119e51e\n #40 system_call_fastpath at ffffffff815afa89\n\nDave Chinner has properly pointed out that this is a deadlock in the\nreclaim code because ext4 doesn't submit pages which are marked by\nPG_writeback right away.\n\nThe heuristic was introduced by commit e62e384e9da8 (\"memcg: prevent OOM\nwith too many dirty pages\") and it was applied only when may_enter_fs\nwas specified.  The code has been changed by c3b94f44fcb0 (\"memcg:\nfurther prevent OOM with too many dirty pages\") which has removed the\n__GFP_FS restriction with a reasoning that we do not get into the fs\ncode.  But this is not sufficient apparently because the fs doesn't\nnecessarily submit pages marked PG_writeback for IO right away.\n\next4_bio_write_page calls io_submit_add_bh but that doesn't necessarily\nsubmit the bio.  Instead it tries to map more pages into the bio and\nmpage_map_one_extent might trigger memcg charge which might end up\nwaiting on a page which is marked PG_writeback but hasn't been submitted\nyet so we would end up waiting for something that never finishes.\n\nFix this issue by replacing __GFP_IO by may_enter_fs check (for case 2)\nbefore we go to wait on the writeback.  The page fault path, which is\nthe only path that triggers memcg oom killer since 3.12, shouldn't\nrequire GFP_NOFS and so we shouldn't reintroduce the premature OOM\nkiller issue which was originally addressed by the heuristic.\n\nAs per David Chinner the xfs is doing similar thing since 2.6.15 already\nso ext4 is not the only affected filesystem.  Moreover he notes:\n\n: For example: IO completion might require unwritten extent conversion\n: which executes filesystem transactions and GFP_NOFS allocations. The\n: writeback flag on the pages can not be cleared until unwritten\n: extent conversion completes. Hence memory reclaim cannot wait on\n: page writeback to complete in GFP_NOFS context because it is not\n: safe to do so, memcg reclaim or otherwise.\n\nCc: stable@vger.kernel.org # 3.9+\n[tytso@mit.edu: corrected the control flow]\nFixes: c3b94f44fcb0 (\"memcg: further prevent OOM with too many dirty pages\")\nReported-by: Nikolay Borisov <kernel@kyup.com>\nSigned-off-by: Michal Hocko <mhocko@suse.cz>\nSigned-off-by: Hugh Dickins <hughd@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/fd8b90b6a2f7e062174b907c0b51fa9b69229484"},{"sha":"ff31bd0987e2797d00ed0b7206e69c5ce58239af","author":{"name":"Ben Segall","email":"99eb0c7a4f3a18874efff9726ade52c2b7beb2eb@google.com"},"message":"sched/fair: Prevent throttling in early pick_next_task_fair()\n\n[ Upstream commit 54d27365cae88fbcc853b391dcd561e71acb81fa ]\n\nThe optimized task selection logic optimistically selects a new task\nto run without first doing a full put_prev_task(). This is so that we\ncan avoid a put/set on the common ancestors of the old and new task.\n\nSimilarly, we should only call check_cfs_rq_runtime() to throttle\neligible groups if they're part of the common ancestry, otherwise it\nis possible to end up with no eligible task in the simple task\nselection.\n\nImagine:\n\t\t/root\n\t/prev\t\t/next\n\t/A\t\t/B\n\nIf our optimistic selection ends up throttling /next, we goto simple\nand our put_prev_task() ends up throttling /prev, after which we're\ngoing to bug out in set_next_entity() because there aren't any tasks\nleft.\n\nAvoid this scenario by only throttling common ancestors.\n\nReported-by: Mohammed Naser <mnaser@vexxhost.com>\nReported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nSigned-off-by: Ben Segall <bsegall@google.com>\n[ munged Changelog ]\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Roman Gushchin <klamm@yandex-team.ru>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: pjt@google.com\nFixes: 678d5718d8d0 (\"sched/fair: Optimize cgroup pick_next_task_fair()\")\nLink: http://lkml.kernel.org/r/xm26wq1oswoq.fsf@sword-of-the-dawn.mtv.corp.google.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/ff31bd0987e2797d00ed0b7206e69c5ce58239af"},{"sha":"1542c1ba29c1d884906680a7a6e5b333317f3523","author":{"name":"Martijn Coenen","email":"af3eddcbb421ceabee93fcfeaefd7af1c6299549@google.com"},"message":"memcg: only free spare array when readers are done\n\n[ Upstream commit 6611d8d76132f86faa501de9451a89bf23fb2371 ]\n\nA spare array holding mem cgroup threshold events is kept around to make\nsure we can always safely deregister an event and have an array to store\nthe new set of events in.\n\nIn the scenario where we're going from 1 to 0 registered events, the\npointer to the primary array containing 1 event is copied to the spare\nslot, and then the spare slot is freed because no events are left.\nHowever, it is freed before calling synchronize_rcu(), which means\nreaders may still be accessing threshold->primary after it is freed.\n\nFixed by only freeing after synchronize_rcu().\n\nSigned-off-by: Martijn Coenen <maco@google.com>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nAcked-by: Michal Hocko <mhocko@suse.com>\nCc: Vladimir Davydov <vdavydov@virtuozzo.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/1542c1ba29c1d884906680a7a6e5b333317f3523"},{"sha":"0abd200de4293168526f96ccd68b55a30ebcf596","author":{"name":"Wenwei Tao","email":"0e72ee3013ec017755f9dc9cfdf29e38735cbb85@gmail.com"},"message":"cgroup: remove redundant cleanup in css_create\n\n[ Upstream commit b00c52dae6d9ee8d0f2407118ef6544ae5524781 ]\n\nWhen create css failed, before call css_free_rcu_fn, we remove the css\nid and exit the percpu_ref, but we will do these again in\ncss_free_work_fn, so they are redundant.  Especially the css id, that\nwould cause problem if we remove it twice, since it may be assigned to\nanother css after the first remove.\n\ntj: This was broken by two commits updating the free path without\n    synchronizing the creation failure path.  This can be easily\n    triggered by trying to create more than 64k memory cgroups.\n\nSigned-off-by: Wenwei Tao <ww.tao0320@gmail.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nCc: Vladimir Davydov <vdavydov@parallels.com>\nFixes: 9a1049da9bd2 (\"percpu-refcount: require percpu_ref to be exited explicitly\")\nFixes: 01e586598b22 (\"cgroup: release css->id after css_free\")\nCc: stable@vger.kernel.org # v3.17+\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/0abd200de4293168526f96ccd68b55a30ebcf596"},{"sha":"795a18304d80ae183a108ba2aa0c6fe269ea8318","author":{"name":"Dominik Dingel","email":"e4eec31eaaceadfd7524a02c0f8fb731a6367f90@linux.vnet.ibm.com"},"message":"sched: access local runqueue directly in single_task_running\n\n[ Upstream commit 00cc1633816de8c95f337608a1ea64e228faf771 ]\n\nCommit 2ee507c47293 (\"sched: Add function single_task_running to let a task\ncheck if it is the only task running on a cpu\") referenced the current\nrunqueue with the smp_processor_id.  When CONFIG_DEBUG_PREEMPT is enabled,\nthat is only allowed if preemption is disabled or the currrent task is\nbound to the local cpu (e.g. kernel worker).\n\nWith commit f78195129963 (\"kvm: add halt_poll_ns module parameter\") KVM\ncalls single_task_running. If CONFIG_DEBUG_PREEMPT is enabled that\ngenerates a lot of kernel messages.\n\nTo avoid adding preemption in that cases, as it would limit the usefulness,\nwe change single_task_running to access directly the cpu local runqueue.\n\nCc: Tim Chen <tim.c.chen@linux.intel.com>\nSuggested-by: Peter Zijlstra <peterz@infradead.org>\nAcked-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: <stable@vger.kernel.org>\nFixes: 2ee507c472939db4b146d545352b8a7c79ef47f8\nSigned-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/795a18304d80ae183a108ba2aa0c6fe269ea8318"},{"sha":"f5cb5462bfb2e3243a1efbd3b3bebbb1486672ed","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"sched/core: Fix TASK_DEAD race in finish_task_switch()\n\n[ Upstream commit 95913d97914f44db2b81271c2e2ebd4d2ac2df83 ]\n\nSo the problem this patch is trying to address is as follows:\n\n        CPU0                            CPU1\n\n        context_switch(A, B)\n                                        ttwu(A)\n                                          LOCK A->pi_lock\n                                          A->on_cpu == 0\n        finish_task_switch(A)\n          prev_state = A->state  <-.\n          WMB                      |\n          A->on_cpu = 0;           |\n          UNLOCK rq0->lock         |\n                                   |    context_switch(C, A)\n                                   `--  A->state = TASK_DEAD\n          prev_state == TASK_DEAD\n            put_task_struct(A)\n                                        context_switch(A, C)\n                                        finish_task_switch(A)\n                                          A->state == TASK_DEAD\n                                            put_task_struct(A)\n\nThe argument being that the WMB will allow the load of A->state on CPU0\nto cross over and observe CPU1's store of A->state, which will then\nresult in a double-drop and use-after-free.\n\nNow the comment states (and this was true once upon a long time ago)\nthat we need to observe A->state while holding rq->lock because that\nwill order us against the wakeup; however the wakeup will not in fact\nacquire (that) rq->lock; it takes A->pi_lock these days.\n\nWe can obviously fix this by upgrading the WMB to an MB, but that is\nexpensive, so we'd rather avoid that.\n\nThe alternative this patch takes is: smp_store_release(&A->on_cpu, 0),\nwhich avoids the MB on some archs, but not important ones like ARM.\n\nReported-by: Oleg Nesterov <oleg@redhat.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nAcked-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: <stable@vger.kernel.org> # v3.1+\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: linux-kernel@vger.kernel.org\nCc: manfred@colorfullife.com\nCc: will.deacon@arm.com\nFixes: e4a52bcb9a18 (\"sched: Remove rq->lock from the first half of ttwu()\")\nLink: http://lkml.kernel.org/r/20150929124509.GG3816@twins.programming.kicks-ass.net\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/f5cb5462bfb2e3243a1efbd3b3bebbb1486672ed"},{"sha":"603e005c479ddf4f033925cdbd24a3556f8e5736","author":{"name":"Raghavendra K T","email":"6fefdf6188dc12a6ddf8d6255a1de7d2cb64b5e7@linux.vnet.ibm.com"},"message":"sched: Fix crash in sched_init_numa()\n\n[ Upstream commit 9c03ee147193645be4c186d3688232fa438c57c7 ]\n\nThe following PowerPC commit:\n\n  c118baf80256 (\"arch/powerpc/mm/numa.c: do not allocate bootmem memory for non existing nodes\")\n\navoids allocating bootmem memory for non existent nodes.\n\nBut when DEBUG_PER_CPU_MAPS=y is enabled, my powerNV system failed to boot\nbecause in sched_init_numa(), cpumask_or() operation was done on\nunallocated nodes.\n\nFix that by making cpumask_or() operation only on existing nodes.\n\n[ Tested with and w/o DEBUG_PER_CPU_MAPS=y on x86 and PowerPC. ]\n\nReported-by: Jan Stancek <jstancek@redhat.com>\nTested-by: Jan Stancek <jstancek@redhat.com>\nSigned-off-by: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>\nCc: <gkurz@linux.vnet.ibm.com>\nCc: <grant.likely@linaro.org>\nCc: <nikunj@linux.vnet.ibm.com>\nCc: <vdavydov@parallels.com>\nCc: <linuxppc-dev@lists.ozlabs.org>\nCc: <linux-mm@kvack.org>\nCc: <peterz@infradead.org>\nCc: <benh@kernel.crashing.org>\nCc: <paulus@samba.org>\nCc: <mpe@ellerman.id.au>\nCc: <anton@samba.org>\nLink: http://lkml.kernel.org/r/1452884483-11676-1-git-send-email-raghavendra.kt@linux.vnet.ibm.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/603e005c479ddf4f033925cdbd24a3556f8e5736"},{"sha":"d202c7bb57f8b175ed5c577a3a0a72cdc6ea76d5","author":{"name":"Chris Friesen","email":"4aa40a2ddad714cdfee6dc44c64c9033ca1ee6f3@mail.usask.ca"},"message":"sched/cputime: Fix steal_account_process_tick() to always return jiffies\n\n[ Upstream commit f9c904b7613b8b4c85b10cd6b33ad41b2843fa9d ]\n\nThe callers of steal_account_process_tick() expect it to return\nwhether a jiffy should be considered stolen or not.\n\nCurrently the return value of steal_account_process_tick() is in\nunits of cputime, which vary between either jiffies or nsecs\ndepending on CONFIG_VIRT_CPU_ACCOUNTING_GEN.\n\nIf cputime has nsecs granularity and there is a tiny amount of\nstolen time (a few nsecs, say) then we will consider the entire\ntick stolen and will not account the tick on user/system/idle,\ncausing /proc/stats to show invalid data.\n\nThe fix is to change steal_account_process_tick() to accumulate\nthe stolen time and only account it once it's worth a jiffy.\n\n(Thanks to Frederic Weisbecker for suggestions to fix a bug in my\nfirst version of the patch.)\n\nSigned-off-by: Chris Friesen <chris.friesen@windriver.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nReviewed-by: Thomas Gleixner <tglx@linutronix.de>\nCc: <stable@vger.kernel.org>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/56DBBDB8.40305@mail.usask.ca\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/d202c7bb57f8b175ed5c577a3a0a72cdc6ea76d5"},{"sha":"273cd2f4d20ef456bef59e9757c0866088300520","author":{"name":"Balbir Singh","email":"daca7b412031fb0e95d58c31aac905f736b2d1c1@gmail.com"},"message":"sched/core: Fix a race between try_to_wake_up() and a woken up task\n\n[ Upstream commit 135e8c9250dd5c8c9aae5984fde6f230d0cbfeaf ]\n\nThe origin of the issue I've seen is related to\na missing memory barrier between check for task->state and\nthe check for task->on_rq.\n\nThe task being woken up is already awake from a schedule()\nand is doing the following:\n\n\tdo {\n\t\tschedule()\n\t\tset_current_state(TASK_(UN)INTERRUPTIBLE);\n\t} while (!cond);\n\nThe waker, actually gets stuck doing the following in\ntry_to_wake_up():\n\n\twhile (p->on_cpu)\n\t\tcpu_relax();\n\nAnalysis:\n\nThe instance I've seen involves the following race:\n\n CPU1\t\t\t\t\tCPU2\n\n while () {\n   if (cond)\n     break;\n   do {\n     schedule();\n     set_current_state(TASK_UN..)\n   } while (!cond);\n\t\t\t\t\twakeup_routine()\n\t\t\t\t\t  spin_lock_irqsave(wait_lock)\n   raw_spin_lock_irqsave(wait_lock)\t  wake_up_process()\n }\t\t\t\t\t  try_to_wake_up()\n set_current_state(TASK_RUNNING);\t  ..\n list_del(&waiter.list);\n\nCPU2 wakes up CPU1, but before it can get the wait_lock and set\ncurrent state to TASK_RUNNING the following occurs:\n\n CPU3\n wakeup_routine()\n raw_spin_lock_irqsave(wait_lock)\n if (!list_empty)\n   wake_up_process()\n   try_to_wake_up()\n   raw_spin_lock_irqsave(p->pi_lock)\n   ..\n   if (p->on_rq && ttwu_wakeup())\n   ..\n   while (p->on_cpu)\n     cpu_relax()\n   ..\n\nCPU3 tries to wake up the task on CPU1 again since it finds\nit on the wait_queue, CPU1 is spinning on wait_lock, but immediately\nafter CPU2, CPU3 got it.\n\nCPU3 checks the state of p on CPU1, it is TASK_UNINTERRUPTIBLE and\nthe task is spinning on the wait_lock. Interestingly since p->on_rq\nis checked under pi_lock, I've noticed that try_to_wake_up() finds\np->on_rq to be 0. This was the most confusing bit of the analysis,\nbut p->on_rq is changed under runqueue lock, rq_lock, the p->on_rq\ncheck is not reliable without this fix IMHO. The race is visible\n(based on the analysis) only when ttwu_queue() does a remote wakeup\nvia ttwu_queue_remote. In which case the p->on_rq change is not\ndone uder the pi_lock.\n\nThe result is that after a while the entire system locks up on\nthe raw_spin_irqlock_save(wait_lock) and the holder spins infintely\n\nReproduction of the issue:\n\nThe issue can be reproduced after a long run on my system with 80\nthreads and having to tweak available memory to very low and running\nmemory stress-ng mmapfork test. It usually takes a long time to\nreproduce. I am trying to work on a test case that can reproduce\nthe issue faster, but thats work in progress. I am still testing the\nchanges on my still in a loop and the tests seem OK thus far.\n\nBig thanks to Benjamin and Nick for helping debug this as well.\nBen helped catch the missing barrier, Nick caught every missing\nbit in my theory.\n\nSigned-off-by: Balbir Singh <bsingharora@gmail.com>\n[ Updated comment to clarify matching barriers. Many\n  architectures do not have a full barrier in switch_to()\n  so that cannot be relied upon. ]\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nAcked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nCc: Alexey Kardashevskiy <aik@ozlabs.ru>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Nicholas Piggin <nicholas.piggin@gmail.com>\nCc: Nicholas Piggin <npiggin@gmail.com>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: <stable@vger.kernel.org>\nLink: http://lkml.kernel.org/r/e02cce7b-d9ca-1ad0-7a61-ea97c7582b37@gmail.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/273cd2f4d20ef456bef59e9757c0866088300520"},{"sha":"2ee1b9ce20a8fbb0a24824d4f0d3ff61139cc485","author":{"name":"mdalexca","email":"6904a290c267cf5f33bdf47657c1786fb7feccef@linux.com"},"message":"defconfig: enable cpusets","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/2ee1b9ce20a8fbb0a24824d4f0d3ff61139cc485"},{"sha":"c55c1f4565a008ddb9f6857385ca7b574a3246c4","author":{"name":"mdalexca","email":"6904a290c267cf5f33bdf47657c1786fb7feccef@linux.com"},"message":"build: R12","distinct":true,"url":"https://api.github.com/repos/mdalexca/OP3/commits/c55c1f4565a008ddb9f6857385ca7b574a3246c4"}]}
{"actor":{"display_login":"mdalexca"}}