From owner-dev-commits-src-main@freebsd.org Fri May 21 12:35:40 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B3A2C631423; Fri, 21 May 2021 12:35:40 +0000 (UTC) (envelope-from hps@selasky.org) Received: from mail.turbocat.net (turbocat.net [IPv6:2a01:4f8:c17:6c4b::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4FmmKm2H5qz3tGw; Fri, 21 May 2021 12:35:39 +0000 (UTC) (envelope-from hps@selasky.org) Received: from hps2020.home.selasky.org (unknown [178.17.145.105]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.turbocat.net (Postfix) with ESMTPSA id D52A3260100; Fri, 21 May 2021 14:35:37 +0200 (CEST) Subject: Re: git: b764a426534f - main - There is a window where threads are removed from the process list and where the thread destructor is invoked. Catch that window by waiting for all task_struct allocations to be returned before freeing the UMA zone in the LinuxKPI. Else UMA may fail to release the zone due to concurrent access and panic: To: Konstantin Belousov Cc: src-committers@freebsd.org, dev-commits-src-all@freebsd.org, dev-commits-src-main@freebsd.org References: <202105211121.14LBLHI2026834@gitrepo.freebsd.org> From: Hans Petter Selasky Message-ID: <909153c4-695b-ebc9-419d-ce3d3da38dcc@selasky.org> Date: Fri, 21 May 2021 14:34:17 +0200 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:78.0) Gecko/20100101 Thunderbird/78.10.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 4FmmKm2H5qz3tGw X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[] X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 May 2021 12:35:40 -0000 On 5/21/21 1:51 PM, Konstantin Belousov wrote: > On Fri, May 21, 2021 at 11:21:17AM +0000, Hans Petter Selasky wrote: >> The branch main has been updated by hselasky: >> >> URL: https://cgit.FreeBSD.org/src/commit/?id=b764a426534f2f5f86d6625288c74dafdbc94d2b >> >> commit b764a426534f2f5f86d6625288c74dafdbc94d2b >> Author: Hans Petter Selasky >> AuthorDate: 2021-05-21 11:17:42 +0000 >> Commit: Hans Petter Selasky >> CommitDate: 2021-05-21 11:18:41 +0000 >> >> There is a window where threads are removed from the process list and where >> the thread destructor is invoked. Catch that window by waiting for all >> task_struct allocations to be returned before freeing the UMA zone in the >> LinuxKPI. Else UMA may fail to release the zone due to concurrent access >> and panic: >> >> panic() - Bad link element prev->next != elm >> zone_release() >> bucket_drain() >> bucket_free() >> zone_dtor() >> zone_free_item() >> uma_zdestroy() >> linux_current_uninit() >> >> This failure can be triggered by loading and unloading the LinuxKPI module >> in a loop: >> >> while true >> do >> kldload linuxkpi >> kldunload linuxkpi >> done >> >> Discussed with: kib@ > No, it was not discussed, with me. > It contains parts of my half-done patches. > And I disagree with what the global counting you added there, both on > principle and on implementation. Let's discuss this off-list. There are not that many choices from what I can see. --HPS