Re: [PATCH] irq_work: Fix IRQ_WORK_BUZY bit clearing

[Leonard Crestez]

On 13.11.2019 19:12, Frederic Weisbecker wrote:
> While attempting to clear the buzy bit at the end of a work execution,
> atomic_cmpxchg() expects the value of the flags with the pending bit
> cleared as the old value. However we are passing by mistake the value of
> the flags before we actually cleared the pending bit.

Busy is spelled with an S

> 
> As a result, clearing the buzy bit fails and irq_work_sync() may stall:
> 
> 	watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [blktrace:4948]
> 	CPU: 0 PID: 4948 Comm: blktrace Not tainted 5.4.0-rc7-00003-gfeb4a51323bab #1
> 	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> 	RIP: 0010:irq_work_sync+0x4/0x10
> 	Call Trace:
> 	  relay_close_buf+0x19/0x50
> 	  relay_close+0x64/0x100
> 	  blk_trace_free+0x1f/0x50
> 	  __blk_trace_remove+0x1e/0x30
> 	  blk_trace_ioctl+0x11b/0x140
> 	  blkdev_ioctl+0x6c1/0xa40
> 	  block_ioctl+0x39/0x40
> 	  do_vfs_ioctl+0xa5/0x700
> 	  ksys_ioctl+0x70/0x80
> 	  __x64_sys_ioctl+0x16/0x20
> 	  do_syscall_64+0x5b/0x1d0
> 	  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> So clear the appropriate bit before passing the old flags to cmpxchg().
> 
> Reported-by: kernel test robot <rong.a.chen@xxxxxxxxx>
> Reported-by: Leonard Crestez <leonard.crestez@xxxxxxx>
> Fixes: feb4a51323ba ("irq_work: Slightly simplify IRQ_WORK_PENDING clearing")
> Signed-off-by: Frederic Weisbecker <frederic@xxxxxxxxxx>
> Cc: Paul E . McKenney <paulmck@xxxxxxxxxxxxxxxxxx>
> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx> everywhere.
> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Cc: Ingo Molnar <mingo@xxxxxxxxxx>

Tested-by: Leonard Crestez <leonard.crestez@xxxxxxx>

Without this patch switching cpufreq governors hangs on arm64.

> ---
>   kernel/irq_work.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/irq_work.c b/kernel/irq_work.c
> index 49c53f80a13a..828cc30774bc 100644
> --- a/kernel/irq_work.c
> +++ b/kernel/irq_work.c
> @@ -158,6 +158,7 @@ static void irq_work_run_list(struct llist_head *list)
>   		 * Clear the BUSY bit and return to the free state if
>   		 * no-one else claimed it meanwhile.
>   		 */
> +		flags &= ~IRQ_WORK_PENDING;
>   		(void)atomic_cmpxchg(&work->flags, flags, flags & ~IRQ_WORK_BUSY);
>   	}
>   }
>