tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mm/damon/core: fix damos_walk() vs kdamond_fn() exit race

When kdamond_fn() main loop is finished, the function cancels remaining
damos_walk() request and unset the damon_ctx->kdamond so that API callers
and API functions themselves can show the context is terminated.
damos_walk() adds the caller's request to the queue first. After that, it
shows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond
is set). Only if the kdamond is running, damos_walk() starts waiting for
the kdamond's handling of the newly added request.

The damos_walk() requests registration and damon_ctx->kdamond unset are
protected by different mutexes, though. Hence, damos_walk() could race
with damon_ctx->kdamond unset, and result in deadlocks.

For example, let's suppose kdamond successfully finished the damow_walk()
request cancelling. Right after that, damos_walk() is called for the
context. It registers the new request, and shows the context is still
running, because damon_ctx->kdamond unset is not yet done. Hence the
damos_walk() caller starts waiting for the handling of the request.
However, the kdamond is already on the termination steps, so it never
handles the new request. As a result, the damos_walk() caller thread
infinitely waits.

Fix this by introducing another damon_ctx field, namely
walk_control_obsolete. It is protected by the
damon_ctx->walk_control_lock, which protects damos_walk() request
registration. Initialize (unset) it in kdamond_fn() before letting
damon_start() returns and set it just before the cancelling of the
remaining damos_walk() request is executed. damos_walk() reads the
obsolete field under the lock and avoids adding a new request.

After this change, only requests that are guaranteed to be handled or
cancelled are registered. Hence the after-registration DAMON context
termination check is no longer needed. Remove it together.

The issue is found by sashiko [1].


Link: https://lore.kernel.org/20260327233319.3528-3-sj@kernel.org
Link: https://lore.kernel.org/20260325141956.87144-1-sj@kernel.org [1]
Fixes: bf0eaba0ff9c ("mm/damon/core: implement damos_walk()")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.14.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

SeongJae Park and committed by
Andrew Morton 33c3f6c2 55da8166

+15 -7
+1
include/linux/damon.h
··· 822 822 struct mutex call_controls_lock; 823 823 824 824 struct damos_walk_control *walk_control; 825 + bool walk_control_obsolete; 825 826 struct mutex walk_control_lock; 826 827 827 828 /*
+14 -7
mm/damon/core.c
··· 1637 1637 * passed at least one &damos->apply_interval_us, kdamond marks the request as 1638 1638 * completed so that damos_walk() can wakeup and return. 1639 1639 * 1640 + * Note that this function should be called only after damon_start() with the 1641 + * @ctx has succeeded. Otherwise, this function could fall into an indefinite 1642 + * wait. 1643 + * 1640 1644 * Return: 0 on success, negative error code otherwise. 1641 1645 */ 1642 1646 int damos_walk(struct damon_ctx *ctx, struct damos_walk_control *control) ··· 1648 1644 init_completion(&control->completion); 1649 1645 control->canceled = false; 1650 1646 mutex_lock(&ctx->walk_control_lock); 1647 + if (ctx->walk_control_obsolete) { 1648 + mutex_unlock(&ctx->walk_control_lock); 1649 + return -ECANCELED; 1650 + } 1651 1651 if (ctx->walk_control) { 1652 1652 mutex_unlock(&ctx->walk_control_lock); 1653 1653 return -EBUSY; 1654 1654 } 1655 1655 ctx->walk_control = control; 1656 1656 mutex_unlock(&ctx->walk_control_lock); 1657 - if (!damon_is_running(ctx)) { 1658 - mutex_lock(&ctx->walk_control_lock); 1659 - if (ctx->walk_control == control) 1660 - ctx->walk_control = NULL; 1661 - mutex_unlock(&ctx->walk_control_lock); 1662 - return -EINVAL; 1663 - } 1664 1657 wait_for_completion(&control->completion); 1665 1658 if (control->canceled) 1666 1659 return -ECANCELED; ··· 2933 2932 mutex_lock(&ctx->call_controls_lock); 2934 2933 ctx->call_controls_obsolete = false; 2935 2934 mutex_unlock(&ctx->call_controls_lock); 2935 + mutex_lock(&ctx->walk_control_lock); 2936 + ctx->walk_control_obsolete = false; 2937 + mutex_unlock(&ctx->walk_control_lock); 2936 2938 complete(&ctx->kdamond_started); 2937 2939 kdamond_init_ctx(ctx); 2938 2940 ··· 3050 3046 ctx->call_controls_obsolete = true; 3051 3047 mutex_unlock(&ctx->call_controls_lock); 3052 3048 kdamond_call(ctx, true); 3049 + mutex_lock(&ctx->walk_control_lock); 3050 + ctx->walk_control_obsolete = true; 3051 + mutex_unlock(&ctx->walk_control_lock); 3053 3052 damos_walk_cancel(ctx); 3054 3053 3055 3054 pr_debug("kdamond (%d) finishes\n", current->pid);