Bug 251803

Summary: rctl -a user:test:readiops:throttle=0/user crash the system
Product: Base System Reporter: Christos Chatzaras <chris>
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me CC: jah
Priority: ---    
Version: 12.2-RELEASE   
Hardware: amd64   
OS: Any   
Attachments:
Description Flags
treat throttle=0 rules as deny=0 rules
none
treat throttle=0 rules as throttle_max none

Description Christos Chatzaras 2020-12-13 12:52:02 UTC 
When I run:

rctl -a user:test:readiops:throttle=0/user

the system crash:

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 4; apic id = 04
instruction pointer = 0x20:0xffffffff80bb2fb7
stack pointer = 0x28:0xfffffe00c5b42200
frame pointer = 0x28:0xfffffe00c5b422a0
code segment = base rx0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 53057 (bash)
trap number = 18
panic: integer divide fault
cpuid = 4
time = 1607862919
KDB: stack backtrace:
#0 0xffffffff80c0a8f5 at kdb_backtrace+0x65
#1 0xffffffff80bbeb1b at vpanic+0x17b
#2 0xffffffff80bbe993 at panic+0x43
#3 0xffffffff8108f911 at trap_fatal+0x391
#4 0xffffffff8108ed97 at trap+0x67
#5 0xffffffff81066f38 at calltrap+0x8
#6 0xffffffff80bb03df at racct_add_buf+0x26f
#7 0xffffffff80c6c0ea at breadn_flags+0xda
#8 0xffffffff80c70a5f at vfs_bio_getpages+0x33f
#9 0xffffffff80ed01a7 at ffs_getpages+0x77
#10 0xffffffff8124911b at VOP_GETPAGES_APV+0x7b
#11 0xffffffff80f1c932 at vnode_pager_getpages+0x72
#12 0xffffffff80f13382 at vm_pager_get_pages+0x22
#13 0xffffffff80b78018 at exec_map_first_page+0x2a8
#14 0xffffffff80b76965 at kern_execve+0x2c5
#15 0xffffffff80b7635c at sys_execve+0x4c
#16 0xffffffff810904c7 at amd64_syscall+0x387
#17 0xffffffff8106785e at fast_syscall_common+0xf8
Uptime: 3m41s
Comment 1 Jason A. Harmening freebsd_committer freebsd_triage 2020-12-18 23:55:35 UTC 
Created attachment 220704 [details]
treat throttle=0 rules as deny=0 rules
Comment 2 Jason A. Harmening freebsd_committer freebsd_triage 2020-12-18 23:57:02 UTC 
Looks like rctl_enforce() is blowing up when it tries to scale the throttle timeout according to the specified limit, which in this case produces division by zero.

In general, it doesn't seem like attempting to throttle resource usage to 0 makes sense; it seems like this should instead be treated as a request to deny the resource and checked as such.

Can you try the attached patch?
Comment 3 Jason A. Harmening freebsd_committer freebsd_triage 2020-12-20 10:19:26 UTC 
Created attachment 220739 [details]
treat throttle=0 rules as throttle_max

On second thought, it might make more sense to treat throttle=0 as "suspend forward progress as long as possible", in other words kern.racct.rctl.throttle_max.
Comment 4 Christos Chatzaras 2020-12-20 10:25:27 UTC 
I will try the patch and I will inform you soon.
Comment 5 Christos Chatzaras 2020-12-30 14:25:21 UTC 
Sorry for the delay. I test it today and everything is ok. After commit to head are you going to MFC it to 12-STABLE?
Comment 6 commit-hook freebsd_committer freebsd_triage 2021-01-11 23:37:38 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=e8a5a1ad7154dc34e3a5234267e19faa86d5ff33

commit e8a5a1ad7154dc34e3a5234267e19faa86d5ff33
Author:     Jason A. Harmening <jah@FreeBSD.org>
AuthorDate: 2020-12-30 23:29:44 +0000
Commit:     Jason A. Harmening <jah@FreeBSD.org>
CommitDate: 2021-01-11 23:36:57 +0000

    rctl(4): support throttling resource usage to 0

    For rate-based resources that support throttling (e.g.
    readiops/writeips), this fixes a divide-by-zero panic when rctl(8)
    passes 0 as the throttle value.  For these resources, treat
    zero-throttle requests as requests to suspend forward progress as long
    as possible using the duration specified in
    kern.racct.rctl.throttle_max.

    PR:             251803
    Reported by:    chris@cretaforce.gr
    Reviewed by:    kib
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D27858

 sys/kern/kern_rctl.c | 5 +++++
 1 file changed, 5 insertions(+)
Comment 7 commit-hook freebsd_committer freebsd_triage 2021-01-26 03:56:57 UTC 
A commit in branch stable/12 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=70cdab054c8ffe7f5561ab8f31db33ee62d12c9c

commit 70cdab054c8ffe7f5561ab8f31db33ee62d12c9c
Author:     Jason A. Harmening <jah@FreeBSD.org>
AuthorDate: 2020-12-30 23:29:44 +0000
Commit:     Jason A. Harmening <jah@FreeBSD.org>
CommitDate: 2021-01-26 03:57:44 +0000

    rctl(4): support throttling resource usage to 0

    For rate-based resources that support throttling (e.g.
    readiops/writeips), this fixes a divide-by-zero panic when rctl(8)
    passes 0 as the throttle value.  For these resources, treat
    zero-throttle requests as requests to suspend forward progress as long
    as possible using the duration specified in
    kern.racct.rctl.throttle_max.

    PR:             251803
    Reported by:    chris@cretaforce.gr

    (cherry picked from commit e8a5a1ad7154dc34e3a5234267e19faa86d5ff33)

 sys/kern/kern_rctl.c | 5 +++++
 1 file changed, 5 insertions(+)