Bug 251803 - rctl -a user:test:readiops:throttle=0/user crash the system
Summary: rctl -a user:test:readiops:throttle=0/user crash the system
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.2-RELEASE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-12-13 12:52 UTC by Christos Chatzaras
Modified: 2021-01-11 23:37 UTC (History)
1 user (show)

See Also:


Attachments
treat throttle=0 rules as deny=0 rules (1.94 KB, patch)
2020-12-18 23:55 UTC, Jason A. Harmening
no flags Details | Diff
treat throttle=0 rules as throttle_max (470 bytes, patch)
2020-12-20 10:19 UTC, Jason A. Harmening
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Christos Chatzaras 2020-12-13 12:52:02 UTC
When I run:

rctl -a user:test:readiops:throttle=0/user

the system crash:

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 4; apic id = 04
instruction pointer = 0x20:0xffffffff80bb2fb7
stack pointer = 0x28:0xfffffe00c5b42200
frame pointer = 0x28:0xfffffe00c5b422a0
code segment = base rx0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 53057 (bash)
trap number = 18
panic: integer divide fault
cpuid = 4
time = 1607862919
KDB: stack backtrace:
#0 0xffffffff80c0a8f5 at kdb_backtrace+0x65
#1 0xffffffff80bbeb1b at vpanic+0x17b
#2 0xffffffff80bbe993 at panic+0x43
#3 0xffffffff8108f911 at trap_fatal+0x391
#4 0xffffffff8108ed97 at trap+0x67
#5 0xffffffff81066f38 at calltrap+0x8
#6 0xffffffff80bb03df at racct_add_buf+0x26f
#7 0xffffffff80c6c0ea at breadn_flags+0xda
#8 0xffffffff80c70a5f at vfs_bio_getpages+0x33f
#9 0xffffffff80ed01a7 at ffs_getpages+0x77
#10 0xffffffff8124911b at VOP_GETPAGES_APV+0x7b
#11 0xffffffff80f1c932 at vnode_pager_getpages+0x72
#12 0xffffffff80f13382 at vm_pager_get_pages+0x22
#13 0xffffffff80b78018 at exec_map_first_page+0x2a8
#14 0xffffffff80b76965 at kern_execve+0x2c5
#15 0xffffffff80b7635c at sys_execve+0x4c
#16 0xffffffff810904c7 at amd64_syscall+0x387
#17 0xffffffff8106785e at fast_syscall_common+0xf8
Uptime: 3m41s
Comment 1 Jason A. Harmening freebsd_committer 2020-12-18 23:55:35 UTC
Created attachment 220704 [details]
treat throttle=0 rules as deny=0 rules
Comment 2 Jason A. Harmening freebsd_committer 2020-12-18 23:57:02 UTC
Looks like rctl_enforce() is blowing up when it tries to scale the throttle timeout according to the specified limit, which in this case produces division by zero.

In general, it doesn't seem like attempting to throttle resource usage to 0 makes sense; it seems like this should instead be treated as a request to deny the resource and checked as such.

Can you try the attached patch?
Comment 3 Jason A. Harmening freebsd_committer 2020-12-20 10:19:26 UTC
Created attachment 220739 [details]
treat throttle=0 rules as throttle_max

On second thought, it might make more sense to treat throttle=0 as "suspend forward progress as long as possible", in other words kern.racct.rctl.throttle_max.
Comment 4 Christos Chatzaras 2020-12-20 10:25:27 UTC
I will try the patch and I will inform you soon.
Comment 5 Christos Chatzaras 2020-12-30 14:25:21 UTC
Sorry for the delay. I test it today and everything is ok. After commit to head are you going to MFC it to 12-STABLE?
Comment 6 commit-hook freebsd_committer 2021-01-11 23:37:38 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=e8a5a1ad7154dc34e3a5234267e19faa86d5ff33

commit e8a5a1ad7154dc34e3a5234267e19faa86d5ff33
Author:     Jason A. Harmening <jah@FreeBSD.org>
AuthorDate: 2020-12-30 23:29:44 +0000
Commit:     Jason A. Harmening <jah@FreeBSD.org>
CommitDate: 2021-01-11 23:36:57 +0000

    rctl(4): support throttling resource usage to 0

    For rate-based resources that support throttling (e.g.
    readiops/writeips), this fixes a divide-by-zero panic when rctl(8)
    passes 0 as the throttle value.  For these resources, treat
    zero-throttle requests as requests to suspend forward progress as long
    as possible using the duration specified in
    kern.racct.rctl.throttle_max.

    PR:             251803
    Reported by:    chris@cretaforce.gr
    Reviewed by:    kib
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D27858

 sys/kern/kern_rctl.c | 5 +++++
 1 file changed, 5 insertions(+)