While running kselftests on arm64 db410c platform "BUG: Invalid wait context" noticed at different runs this specific platform running stable-rc 5.9.12-rc1.
While running these two test cases we have noticed this BUG and not easily reproducible.
# selftests: bpf: test_xdp_redirect.sh # selftests: net: ip6_gre_headroom.sh
[ 245.694901] kauditd_printk_skb: 100 callbacks suppressed [ 245.694913] audit: type=1334 audit(251.699:25757): prog-id=12883 op=LOAD [ 245.735658] audit: type=1334 audit(251.743:25758): prog-id=12884 op=LOAD [ 245.801299] audit: type=1334 audit(251.807:25759): prog-id=12885 op=LOAD [ 245.832034] audit: type=1334 audit(251.839:25760): prog-id=12886 op=LOAD [ 245.888601] [ 245.888631] ============================= [ 245.889156] [ BUG: Invalid wait context ] [ 245.893071] 5.9.12-rc1 #1 Tainted: G W [ 245.897056] ----------------------------- [ 245.902091] pool/1279 is trying to lock: [ 245.906083] ffff000032fc1218 (&child->perf_event_mutex){+.+.}-{3:3}, at: perf_event_exit_task+0x34/0x3a8 [ 245.910085] other info that might help us debug this: [ 245.919539] context-{4:4} [ 245.924484] 1 lock held by pool/1279: [ 245.927087] #0: ffff8000127819b8 (rcu_read_lock){....}-{1:2}, at: dput+0x54/0x460 [ 245.930739] stack backtrace: [ 245.938203] CPU: 1 PID: 1279 Comm: pool Tainted: G W 5.9.12-rc1 #1 [ 245.941243] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) [ 245.948621] Call trace: [ 245.955390] dump_backtrace+0x0/0x1f8 [ 245.957560] show_stack+0x2c/0x38 [ 245.961382] dump_stack+0xec/0x158 [ 245.964679] __lock_acquire+0x59c/0x15c8 [ 245.967978] lock_acquire+0x124/0x4d0 [ 245.972058] __mutex_lock+0xa4/0x970 [ 245.975615] mutex_lock_nested+0x54/0x70 [ 245.979261] perf_event_exit_task+0x34/0x3a8 [ 245.983168] do_exit+0x394/0xad8 [ 245.987420] do_group_exit+0x4c/0xa8 [ 245.990633] get_signal+0x16c/0xb40 [ 245.994193] do_notify_resume+0x2ec/0x678 [ 245.997404] work_pending+0x8/0x200
and BUG in an other run,
[ 1012.068407] audit: type=1700 audit(1018.803:25886): dev=eth0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295 [ 1012.250561] IPv6: ADDRCONF(NETDEV_CHANGE): swp1: link becomes ready [ 1012.251298] IPv6: ADDRCONF(NETDEV_CHANGE): h1: link becomes ready [ 1012.252559] [ 1012.261892] ============================= [ 1012.263453] [ BUG: Invalid wait context ] [ 1012.267363] 5.9.12-rc1 #1 Tainted: G W [ 1012.271354] ----------------------------- [ 1012.276389] systemd/454 is trying to lock: [ 1012.280381] ffff00003985a918 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x60/0xa8 [ 1012.284378] other info that might help us debug this: [ 1012.292275] context-{4:4} [ 1012.297396] 1 lock held by systemd/454: [ 1012.299997] #0: ffff8000127d1f38 (rcu_read_lock){....}-{1:2}, at: path_init+0x40/0x718 [ 1012.303649] stack backtrace: [ 1012.311638] CPU: 2 PID: 454 Comm: systemd Tainted: G W 5.9.12-rc1 #1 [ 1012.314760] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) [ 1012.322139] Call trace: [ 1012.329084] dump_backtrace+0x0/0x1f8 [ 1012.331254] show_stack+0x2c/0x38 [ 1012.335075] dump_stack+0xec/0x158 [ 1012.338371] __lock_acquire+0x59c/0x15c8 [ 1012.341672] lock_acquire+0x124/0x4d0 [ 1012.345751] __might_fault+0x84/0xa8 [ 1012.349311] cp_new_stat+0x114/0x1b8 [ 1012.352956] __do_sys_newfstat+0x44/0x70 [ 1012.356513] __arm64_sys_newfstat+0x24/0x30 [ 1012.358652] IPv6: ADDRCONF(NETDEV_CHANGE): swp3: link becomes ready [ 1012.360424] el0_svc_common.constprop.3+0x7c/0x198 [ 1012.370575] do_el0_svc+0x34/0xa0 [ 1012.375437] el0_sync_handler+0x16c/0x210 [ 1012.378824] el0_sync+0x140/0x180
Full test log links, https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.9.y/build/v5.9.11... https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.9.y/build/v5.9.11...
metadata: git branch: linux-5.9.y git commit: fb49ad2107f4b740257c84ec2991fc6afb447f53 git describe: v5.9.11-153-gfb49ad2107f4 git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git kernel-config: http://snapshots.linaro.org/openembedded/lkft/lkft/sumo/dragonboard-410c/lkf...
Hi Naresh,
On Wed, Dec 02, 2020 at 10:15:44AM +0530, Naresh Kamboju wrote:
While running kselftests on arm64 db410c platform "BUG: Invalid wait context" noticed at different runs this specific platform running stable-rc 5.9.12-rc1.
While running these two test cases we have noticed this BUG and not easily reproducible.
# selftests: bpf: test_xdp_redirect.sh # selftests: net: ip6_gre_headroom.sh
[ 245.694901] kauditd_printk_skb: 100 callbacks suppressed [ 245.694913] audit: type=1334 audit(251.699:25757): prog-id=12883 op=LOAD [ 245.735658] audit: type=1334 audit(251.743:25758): prog-id=12884 op=LOAD [ 245.801299] audit: type=1334 audit(251.807:25759): prog-id=12885 op=LOAD [ 245.832034] audit: type=1334 audit(251.839:25760): prog-id=12886 op=LOAD [ 245.888601] [ 245.888631] ============================= [ 245.889156] [ BUG: Invalid wait context ] [ 245.893071] 5.9.12-rc1 #1 Tainted: G W [ 245.897056] ----------------------------- [ 245.902091] pool/1279 is trying to lock: [ 245.906083] ffff000032fc1218 (&child->perf_event_mutex){+.+.}-{3:3}, at: perf_event_exit_task+0x34/0x3a8 [ 245.910085] other info that might help us debug this: [ 245.919539] context-{4:4} [ 245.924484] 1 lock held by pool/1279: [ 245.927087] #0: ffff8000127819b8 (rcu_read_lock){....}-{1:2}, at: dput+0x54/0x460 [ 245.930739] stack backtrace: [ 245.938203] CPU: 1 PID: 1279 Comm: pool Tainted: G W 5.9.12-rc1 #1 [ 245.941243] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) [ 245.948621] Call trace: [ 245.955390] dump_backtrace+0x0/0x1f8 [ 245.957560] show_stack+0x2c/0x38 [ 245.961382] dump_stack+0xec/0x158 [ 245.964679] __lock_acquire+0x59c/0x15c8 [ 245.967978] lock_acquire+0x124/0x4d0 [ 245.972058] __mutex_lock+0xa4/0x970 [ 245.975615] mutex_lock_nested+0x54/0x70 [ 245.979261] perf_event_exit_task+0x34/0x3a8 [ 245.983168] do_exit+0x394/0xad8 [ 245.987420] do_group_exit+0x4c/0xa8 [ 245.990633] get_signal+0x16c/0xb40 [ 245.994193] do_notify_resume+0x2ec/0x678 [ 245.997404] work_pending+0x8/0x200
For the PoV of lockdep, this means some one tries to acquire a mutex inside an RCU read-side critical section, which is bad, because one can not sleep (voluntarily) inside RCU.
However I don't think it's the true case here, because 1) normally people are very careful not putting mutex or other sleepable locks inside RCU and 2) in the above splats, lockdep find the rcu read lock is held at dput() while the acquiring of the mutex is at ret_to_user(), clearly there is no call site (in the same context) from the RCU read-side critial section of dput() to ret_to_user().
One chance of hitting this is that there is a bug in context/irq tracing that makes the contexts of dput() and ret_to_user() as one contexts so that lockdep gets confused and reports a false postive.
FWIW, I think this might be related to some know issues for ARM64 with lockdep and irq tracing:
https://lore.kernel.org/lkml/20201119225352.GA5251@willie-the-truck/
And Mark already has series to fix them:
https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git/log/?h=arm64/...
But I must defer to Mark for the latest fix ;-)
Regards, Boqun
and BUG in an other run,
[ 1012.068407] audit: type=1700 audit(1018.803:25886): dev=eth0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295 [ 1012.250561] IPv6: ADDRCONF(NETDEV_CHANGE): swp1: link becomes ready [ 1012.251298] IPv6: ADDRCONF(NETDEV_CHANGE): h1: link becomes ready [ 1012.252559] [ 1012.261892] ============================= [ 1012.263453] [ BUG: Invalid wait context ] [ 1012.267363] 5.9.12-rc1 #1 Tainted: G W [ 1012.271354] ----------------------------- [ 1012.276389] systemd/454 is trying to lock: [ 1012.280381] ffff00003985a918 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x60/0xa8 [ 1012.284378] other info that might help us debug this: [ 1012.292275] context-{4:4} [ 1012.297396] 1 lock held by systemd/454: [ 1012.299997] #0: ffff8000127d1f38 (rcu_read_lock){....}-{1:2}, at: path_init+0x40/0x718 [ 1012.303649] stack backtrace: [ 1012.311638] CPU: 2 PID: 454 Comm: systemd Tainted: G W 5.9.12-rc1 #1 [ 1012.314760] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) [ 1012.322139] Call trace: [ 1012.329084] dump_backtrace+0x0/0x1f8 [ 1012.331254] show_stack+0x2c/0x38 [ 1012.335075] dump_stack+0xec/0x158 [ 1012.338371] __lock_acquire+0x59c/0x15c8 [ 1012.341672] lock_acquire+0x124/0x4d0 [ 1012.345751] __might_fault+0x84/0xa8 [ 1012.349311] cp_new_stat+0x114/0x1b8 [ 1012.352956] __do_sys_newfstat+0x44/0x70 [ 1012.356513] __arm64_sys_newfstat+0x24/0x30 [ 1012.358652] IPv6: ADDRCONF(NETDEV_CHANGE): swp3: link becomes ready [ 1012.360424] el0_svc_common.constprop.3+0x7c/0x198 [ 1012.370575] do_el0_svc+0x34/0xa0 [ 1012.375437] el0_sync_handler+0x16c/0x210 [ 1012.378824] el0_sync+0x140/0x180
Full test log links, https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.9.y/build/v5.9.11... https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.9.y/build/v5.9.11...
metadata: git branch: linux-5.9.y git commit: fb49ad2107f4b740257c84ec2991fc6afb447f53 git describe: v5.9.11-153-gfb49ad2107f4 git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git kernel-config: http://snapshots.linaro.org/openembedded/lkft/lkft/sumo/dragonboard-410c/lkf...
-- Linaro LKFT https://lkft.linaro.org
Hi Naresh, Boqun,
On Thu, Dec 03, 2020 at 09:49:22AM +0800, Boqun Feng wrote:
On Wed, Dec 02, 2020 at 10:15:44AM +0530, Naresh Kamboju wrote:
While running kselftests on arm64 db410c platform "BUG: Invalid wait context" noticed at different runs this specific platform running stable-rc 5.9.12-rc1.
While running these two test cases we have noticed this BUG and not easily reproducible.
# selftests: bpf: test_xdp_redirect.sh # selftests: net: ip6_gre_headroom.sh
[ 245.694901] kauditd_printk_skb: 100 callbacks suppressed [ 245.694913] audit: type=1334 audit(251.699:25757): prog-id=12883 op=LOAD [ 245.735658] audit: type=1334 audit(251.743:25758): prog-id=12884 op=LOAD [ 245.801299] audit: type=1334 audit(251.807:25759): prog-id=12885 op=LOAD [ 245.832034] audit: type=1334 audit(251.839:25760): prog-id=12886 op=LOAD [ 245.888601] [ 245.888631] ============================= [ 245.889156] [ BUG: Invalid wait context ] [ 245.893071] 5.9.12-rc1 #1 Tainted: G W [ 245.897056] ----------------------------- [ 245.902091] pool/1279 is trying to lock: [ 245.906083] ffff000032fc1218 (&child->perf_event_mutex){+.+.}-{3:3}, at: perf_event_exit_task+0x34/0x3a8 [ 245.910085] other info that might help us debug this: [ 245.919539] context-{4:4} [ 245.924484] 1 lock held by pool/1279: [ 245.927087] #0: ffff8000127819b8 (rcu_read_lock){....}-{1:2}, at: dput+0x54/0x460 [ 245.930739] stack backtrace: [ 245.938203] CPU: 1 PID: 1279 Comm: pool Tainted: G W 5.9.12-rc1 #1 [ 245.941243] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) [ 245.948621] Call trace: [ 245.955390] dump_backtrace+0x0/0x1f8 [ 245.957560] show_stack+0x2c/0x38 [ 245.961382] dump_stack+0xec/0x158 [ 245.964679] __lock_acquire+0x59c/0x15c8 [ 245.967978] lock_acquire+0x124/0x4d0 [ 245.972058] __mutex_lock+0xa4/0x970 [ 245.975615] mutex_lock_nested+0x54/0x70 [ 245.979261] perf_event_exit_task+0x34/0x3a8 [ 245.983168] do_exit+0x394/0xad8 [ 245.987420] do_group_exit+0x4c/0xa8 [ 245.990633] get_signal+0x16c/0xb40 [ 245.994193] do_notify_resume+0x2ec/0x678 [ 245.997404] work_pending+0x8/0x200
For the PoV of lockdep, this means some one tries to acquire a mutex inside an RCU read-side critical section, which is bad, because one can not sleep (voluntarily) inside RCU.
However I don't think it's the true case here, because 1) normally people are very careful not putting mutex or other sleepable locks inside RCU and 2) in the above splats, lockdep find the rcu read lock is held at dput() while the acquiring of the mutex is at ret_to_user(), clearly there is no call site (in the same context) from the RCU read-side critial section of dput() to ret_to_user().
One chance of hitting this is that there is a bug in context/irq tracing that makes the contexts of dput() and ret_to_user() as one contexts so that lockdep gets confused and reports a false postive.
That sounds likely to me (but I haven't looked too deeply at the above report).
FWIW, I think this might be related to some know issues for ARM64 with lockdep and irq tracing:
https://lore.kernel.org/lkml/20201119225352.GA5251@willie-the-truck/
And Mark already has series to fix them:
https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git/log/?h=arm64/...
But I must defer to Mark for the latest fix ;-)
That went into mainline a few hours ago, and will be part of v5.10-rc7.
So if it's possible to test with mainline, that would be helpful!
Thanks, Mark.
-
Boqun Feng -
Mark Rutland -
Naresh Kamboju