search for: mutex_trylock

...the mutex of paired virtqueue in vhost_net_busy_poll(). But this will results an inconsistent lock order which may cause deadlock if we try to bring back the protection of device IOTLB with vq mutex that requires to hold mutex of all virtqueues at the same time. Fix this simply by switching to use mutex_trylock(), when fail just skip the busy polling. This can happen when device IOTLB is under updating which should be rare. Fixes: commit 78139c94dc8c ("net: vhost: lock the vqs one by one") Cc: Tonghao Zhang <xiangxia.m.yue at gmail.com> Signed-off-by: Jason Wang <jasowang at redhat.com...

...atch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. Please consider them for -stable. Thanks Changes from V2: - drop dirty page fix and make it for net-next Changes from V1: - silent compiler warning for 32bit. - use mutex_trylock() on slowpath instead of mutex_lock() even on fast path. Jason Wang (3): vhost: make sure used idx is seen before log in vhost_add_used_n() vhost_net: switch to use mutex_trylock() in vhost_net_busy_poll() Revert "net: vhost: lock the vqs one by one" drivers/vhost/net.c | 8...

...xb_set_page() >>> xb_preload(GFP_KERNEL) >>> kmalloc(GFP_KERNEL) >>> __alloc_pages_may_oom() >>> Fails to take oom_lock and loop forever >> __alloc_pages_may_oom() uses mutex_trylock(&oom_lock). > Yes. But this mutex_trylock(&oom_lock) is semantically mutex_lock(&oom_lock) > because __alloc_pages_slowpath() will continue looping until > mutex_trylock(&oom_lock) succeeds (or somebody releases memory). > >> I think the second __alloc_pages_may_oo...

...ing when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was done through intorudce HVA->GPA reverse mapping and convert HVA to GPA during logging dirty pages. Please consider them for -stable. Thanks Changes from V1: - silent compiler warning for 32bit. - use mutex_trylock() on slowpath instead of mutex_lock() even on fast path. Jason Wang (4): vhost: make sure used idx is seen before log in vhost_add_used_n() vhost_net: switch to use mutex_trylock() in vhost_net_busy_poll() Revert "net: vhost: lock the vqs one by one" vhost: log dirty page corre...

...ing when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was done through intorudce HVA->GPA reverse mapping and convert HVA to GPA during logging dirty pages. Please consider them for -stable. Thanks Changes from V1: - silent compiler warning for 32bit. - use mutex_trylock() on slowpath instead of mutex_lock() even on fast path. Jason Wang (4): vhost: make sure used idx is seen before log in vhost_add_used_n() vhost_net: switch to use mutex_trylock() in vhost_net_busy_poll() Revert "net: vhost: lock the vqs one by one" vhost: log dirty page corre...

...df/0x150 [ +0.000010] ttm_dma_pool_get_pages+0x1ec/0x4b0 [ +0.000015] ttm_dma_populate+0x24c/0x340 [ +0.000011] ttm_tt_bind+0x23/0x50 [ +0.000006] ttm_bo_handle_move_mem+0x58c/0x5c0 [ +0.000015] ttm_bo_validate+0x152/0x190 [ +0.000004] ? ttm_bo_init_reserved+0x3d8/0x490 [ +0.000012] ? mutex_trylock+0xcd/0xe0 [ +0.000004] ? ttm_bo_handle_move_mem+0x58/0x5c0 [ +0.000007] ttm_bo_init_reserved+0x3f4/0x490 [ +0.000010] ttm_bo_init+0x2f/0xa0 [ +0.000009] ? nouveau_bo_invalidate_caches+0x10/0x10 [ +0.000005] nouveau_bo_new+0x416/0x590 [ +0.000007] ? nouveau_bo_invalidate_caches+0x10/0x10...

I did some btrfs RTFS over the weeking and I have a hard time understanding what this code is attempting to do: 28 int btrfs_tree_lock(struct extent_buffer *eb) 29 { 30 int i; 31 32 if (mutex_trylock(&eb->mutex)) 33 return 0; 34 for (i = 0; i < 512; i++) { 35 cpu_relax(); 36 if (mutex_trylock(&eb->mutex)) 37 return 0; 38 } 39 cpu_relax(); 40 mutex_lock_nested(&eb-...

On Sat, Sep 30, 2017 at 12:05:52PM +0800, Wei Wang wrote: > +static inline void xb_set_page(struct virtio_balloon *vb, > + struct page *page, > + unsigned long *pfn_min, > + unsigned long *pfn_max) > +{ > + unsigned long pfn = page_to_pfn(page); > + > + *pfn_min = min(pfn, *pfn_min); > + *pfn_max = max(pfn, *pfn_max); > +

On Sat, Sep 30, 2017 at 12:05:52PM +0800, Wei Wang wrote: > +static inline void xb_set_page(struct virtio_balloon *vb, > + struct page *page, > + unsigned long *pfn_min, > + unsigned long *pfn_max) > +{ > + unsigned long pfn = page_to_pfn(page); > + > + *pfn_min = min(pfn, *pfn_min); > + *pfn_max = max(pfn, *pfn_max); > +

...* In order to avoid lock contention while migrating pages concurrently @@ -474,8 +474,12 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, * recursion in the case it ends up triggering memory compaction * while it is attempting to inflate the ballon. */ - if (!mutex_trylock(&vb->balloon_lock)) + if (!mutex_trylock(&vb->inflate_lock)) + return -EAGAIN; + if (!mutex_trylock(&vb->deflate_lock)) { + mutex_unlock(&vb->inflate_lock); return -EAGAIN; + } get_page(newpage); /* balloon reference */ @@ -485,17 +489,16 @@ static int virtbal...

...nouveau_drm *drm = nouveau_drm(fbcon->helper.dev); - struct nvif_device *device = &drm->client.device; - int ret; - - if (info->state != FBINFO_STATE_RUNNING) - return; - - ret = -ENODEV; - if (!in_interrupt() && !(info->flags & FBINFO_HWACCEL_DISABLED) && - mutex_trylock(&drm->client.mutex)) { - if (device->info.family < NV_DEVICE_INFO_V0_TESLA) - ret = nv04_fbcon_fillrect(info, rect); - else - if (device->info.family < NV_DEVICE_INFO_V0_FERMI) - ret = nv50_fbcon_fillrect(info, rect); - else - ret = nvc0_fbcon_fillrect(info, rect); - m...

On Wed, Dec 12, 2018 at 06:08:18PM +0800, Jason Wang wrote: > This reverts commit 78139c94dc8c96a478e67dab3bee84dc6eccb5fd. We don't > protect device IOTLB with vq mutex, which will lead e.g use after free > for device IOTLB entries. And since we've switched to use > mutex_trylock() in previous patch, it's safe to revert it without > having deadlock. > > Fixes: commit 78139c94dc8c ("net: vhost: lock the vqs one by one") > Cc: Tonghao Zhang <xiangxia.m.yue at gmail.com> > Signed-off-by: Jason Wang <jasowang at redhat.com> Acked-by:...

...= &drm->client.device; > - int ret; > - > - if (info->state != FBINFO_STATE_RUNNING) > - return; > - > - ret = -ENODEV; > - if (!in_interrupt() && !(info->flags & FBINFO_HWACCEL_DISABLED) && > - mutex_trylock(&drm->client.mutex)) { > - if (device->info.family < NV_DEVICE_INFO_V0_TESLA) > - ret = nv04_fbcon_fillrect(info, rect); > - else > - if (device->info.family < NV_DEVICE_INFO_V0_FERMI) > -...

...t;> - int ret; >> - >> - if (info->state != FBINFO_STATE_RUNNING) >> - return; >> - >> - ret = -ENODEV; >> - if (!in_interrupt() && !(info->flags & FBINFO_HWACCEL_DISABLED) && >> - mutex_trylock(&drm->client.mutex)) { >> - if (device->info.family < NV_DEVICE_INFO_V0_TESLA) >> - ret = nv04_fbcon_fillrect(info, rect); >> - else >> - if (device->info.family < NV_DEVICE_INFO_V0_FERMI) &gt...

...x4b0 >> [ +0.000015] ttm_dma_populate+0x24c/0x340 >> [ +0.000011] ttm_tt_bind+0x23/0x50 >> [ +0.000006] ttm_bo_handle_move_mem+0x58c/0x5c0 >> [ +0.000015] ttm_bo_validate+0x152/0x190 >> [ +0.000004] ? ttm_bo_init_reserved+0x3d8/0x490 >> [ +0.000012] ? mutex_trylock+0xcd/0xe0 >> [ +0.000004] ? ttm_bo_handle_move_mem+0x58/0x5c0 >> [ +0.000007] ttm_bo_init_reserved+0x3f4/0x490 >> [ +0.000010] ttm_bo_init+0x2f/0xa0 >> [ +0.000009] ? nouveau_bo_invalidate_caches+0x10/0x10 >> [ +0.000005] nouveau_bo_new+0x416/0x590 >> [...

...nouveau_drm *drm = nouveau_drm(fbcon->helper.dev); - struct nvif_device *device = &drm->client.device; - int ret; - - if (info->state != FBINFO_STATE_RUNNING) - return; - - ret = -ENODEV; - if (!in_interrupt() && !(info->flags & FBINFO_HWACCEL_DISABLED) && - mutex_trylock(&drm->client.mutex)) { - if (device->info.family < NV_DEVICE_INFO_V0_TESLA) - ret = nv04_fbcon_fillrect(info, rect); - else - if (device->info.family < NV_DEVICE_INFO_V0_FERMI) - ret = nv50_fbcon_fillrect(info, rect); - else - ret = nvc0_fbcon_fillrect(info, rect); - m...

The reason the deadlock is that: Task Btrfs-cleaner umount() down_write(&s->s_umount) sync_filesystem() do auto-defragment and produce lots of dirty pages close_ctree() wait for the end of btrfs-cleaner start_transaction reserve space shrink_delalloc() writeback_inodes_sb_nr_if_idle()

...wrote: >>> This test for range_blockable should be before mutex_lock, I can move >>> it up >>> >> yes, thanks. > > Okay, I wrote it like this: > > if (mmu_notifier_range_blockable(range)) > mutex_lock(&adev->notifier_lock); > else if (!mutex_trylock(&adev->notifier_lock)) > return false; > >>> Also, do you know if notifier_lock is held while calling >>> amdgpu_ttm_tt_get_user_pages_done()? Can we add a 'lock assert held' >>> to amdgpu_ttm_tt_get_user_pages_done()? >> >> gpu side ho...

Hello. I noticed that virtio_balloon is using register_oom_notifier() and leak_balloon() from virtballoon_oom_notify() might depend on __GFP_DIRECT_RECLAIM memory allocation. In leak_balloon(), mutex_lock(&vb->balloon_lock) is called in order to serialize against fill_balloon(). But in fill_balloon(), alloc_page(GFP_HIGHUSER[_MOVABLE] | __GFP_NOMEMALLOC | __GFP_NORETRY) is called with

Hello. I noticed that virtio_balloon is using register_oom_notifier() and leak_balloon() from virtballoon_oom_notify() might depend on __GFP_DIRECT_RECLAIM memory allocation. In leak_balloon(), mutex_lock(&vb->balloon_lock) is called in order to serialize against fill_balloon(). But in fill_balloon(), alloc_page(GFP_HIGHUSER[_MOVABLE] | __GFP_NOMEMALLOC | __GFP_NORETRY) is called with