In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
writeback: report a Tasks-RCU quiescent state per cgwb drain pass<\/p>\n
cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling
\ncleanup_offline_cgwb() until it returns false, with a cond_resched()
\nbetween passes. On a CONFIG_PREEMPTION kernel that cond_resched() does
\nnothing: _cond_resched() is a plain “return 0”, and under PREEMPT_DYNAMIC
\nthe full and lazy modes disable it. Since commit 7dadeaa6e851 (“sched:
\nFurther restrict the preemption modes”) those are the only two models on
\nthe architectures with PREEMPT_LAZY support, arm64 and x86 among them, so
\nthe drain loop never reports a Tasks-RCU quiescent state.<\/p>\n
A worker draining a cgwb with millions of attached inodes runs for
\nminutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one
\ndying cgroup’s writeback domain for over 11 minutes. A BPF program unlink
\n(bpf_trampoline_unlink_prog -> bpf_trampoline_update ->
\nunregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks())
\nwaited on that grace period while holding the trampoline mutex, 42 tasks
\nqueued behind it in D state, and the hung task detector fired at 614 s and
\npanicked the host. Any BPF or ftrace detach during a long drain inherits
\nthe drain’s length.<\/p>\n
Fix this by calling cond_resched_tasks_rcu_qs() so we do not stall out
\nanybody who calls sycnrhonize_rcu_tasks(). We put this in a do { } while
\nloop because if we have many small cgroups cleanup_offline_cgwb() will
\nreturn false and we will never call cond_resched_tasks_rcu_qs(), creating
\nthe same problem.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
writeback: report a Tasks-RCU quiescent state per cgwb drain pass<\/p>\n
cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling
\ncl<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41008","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}