【OLK-5.10】xfs专项测试，执行测试用例test_scene253，触发kernel BUG at fs/xfs/xfs_message.c:110! fs/xfs/xfs_trans.c, line: 622

【严重程度】 严重
【特性】 
【重现类型】 
【定位分析】 </p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">在CPU下线的时候下面的函数工作其实有问题的：</div><div class="ql-code-block" data-language="plain">int __percpu_counter_compare(struct percpu_counter *fbc, s64 rhs, s32 batch)</div><div class="ql-code-block" data-language="plain">{</div><div class="ql-code-block" data-language="plain">        s64     count;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">        count = percpu_counter_read(fbc);</div><div class="ql-code-block" data-language="plain">        /* Check to see if rough count will be sufficient for comparison */</div><div class="ql-code-block" data-language="plain">        if (abs(count - rhs) &gt; (batch * num_online_cpus())) {</div><div class="ql-code-block" data-language="plain">                if (count &gt; rhs)</div><div class="ql-code-block" data-language="plain">                        return 1;</div><div class="ql-code-block" data-language="plain">                else</div><div class="ql-code-block" data-language="plain">                        return -1;</div><div class="ql-code-block" data-language="plain">        }</div><div class="ql-code-block" data-language="plain">        /* Need to use precise count */</div><div class="ql-code-block" data-language="plain">        count = percpu_counter_sum(fbc);</div><div class="ql-code-block" data-language="plain">        if (count &gt; rhs)</div><div class="ql-code-block" data-language="plain">                return 1;</div><div class="ql-code-block" data-language="plain">        else if (count &lt; rhs)</div><div class="ql-code-block" data-language="plain">                return -1;</div><div class="ql-code-block" data-language="plain">        else</div><div class="ql-code-block" data-language="plain">                return 0;</div><div class="ql-code-block" data-language="plain">}</div><div class="ql-code-block" data-language="plain">问题点1：</div><div class="ql-code-block" data-language="plain">对于快速判断的逻辑，和CPU下线并发的时候percpu_counter_cpu_dead在没有调用到之前cpu的数量可能已经变少了。那就导致计算错误。举例如下：</div><div class="ql-code-block" data-language="plain">假设：</div><div class="ql-code-block" data-language="plain">batch = 32</div><div class="ql-code-block" data-language="plain">最终计数是2</div><div class="ql-code-block" data-language="plain">cpu数量为4</div><div class="ql-code-block" data-language="plain">加入cpu3下线的时候percpu变量在各个cpu上的数量如下</div><div class="ql-code-block" data-language="plain">cpu0   cpu1   cpu2   cpu3</div><div class="ql-code-block" data-language="plain"> 31     31     31     31</div><div class="ql-code-block" data-language="plain">fbc-&gt;count = -122</div><div class="ql-code-block" data-language="plain">那么这个时候加入判断fbc是否大于0</div><div class="ql-code-block" data-language="plain">abs(count - rhs) = -122</div><div class="ql-code-block" data-language="plain">batch * num_online_cpus() = 32 * 3 = 96</div><div class="ql-code-block" data-language="plain">也就是：abs(count - rhs) &gt; batch * num_online_cpus()成立</div><div class="ql-code-block" data-language="plain">但是 count &lt; 0 所以返回了-1于实际情况是相反的。</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">问题点2：</div><div class="ql-code-block" data-language="plain">即使快速判断不满足：</div><div class="ql-code-block" data-language="plain">percpu_counter_sum最终的实现如下：</div><div class="ql-code-block" data-language="plain">s64 __percpu_counter_sum(struct percpu_counter *fbc)</div><div class="ql-code-block" data-language="plain">{</div><div class="ql-code-block" data-language="plain">        s64 ret;</div><div class="ql-code-block" data-language="plain">        int cpu;</div><div class="ql-code-block" data-language="plain">        unsigned long flags;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">        raw_spin_lock_irqsave(&amp;fbc-&gt;lock, flags);</div><div class="ql-code-block" data-language="plain">        ret = fbc-&gt;count;</div><div class="ql-code-block" data-language="plain">        for_each_online_cpu(cpu) {</div><div class="ql-code-block" data-language="plain">                s32 *pcount = per_cpu_ptr(fbc-&gt;counters, cpu);</div><div class="ql-code-block" data-language="plain">                ret += *pcount;</div><div class="ql-code-block" data-language="plain">        }</div><div class="ql-code-block" data-language="plain">        raw_spin_unlock_irqrestore(&amp;fbc-&gt;lock, flags);</div><div class="ql-code-block" data-language="plain">        return ret;</div><div class="ql-code-block" data-language="plain">}</div><div class="ql-code-block" data-language="plain">这里遍历的所有oneline CPU，那么在percpu_counter_cpu_dead调用之前这里遍历累加出来的数据必然也是错误比实际值来的小。</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">对percpu变量和cpu下线的问题社区也报过：</div><div class="ql-code-block" data-language="plain"><p>
【影响评估及测试建议】 None
【对外部影响描述】 None

GVP openEuler/kernel

Content Risk Flag

Comments (2)

GVPopenEuler/kernel

Content Risk Flag