Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vader/xpmem: fix finalize #6534

Closed

Conversation

ggouaillardet
Copy link
Contributor

No description provided.

 - check the incremented reference count is > 1
 - remove an extra semi column

Signed-off-by: Gilles Gouaillardet <gilles@rist.or.jp>
perform various tests to make sure the object is valid

Signed-off-by: Gilles Gouaillardet <gilles@rist.or.jp>
make sure mca_btl_vader_endpoint_xpmem_rcache_cleanup() is passed
a valid reg object.

Signed-off-by: Gilles Gouaillardet <gilles@rist.or.jp>
Refs. open-mpi#6524

Signed-off-by: Gilles Gouaillardet <gilles@rist.or.jp>
@ggouaillardet
Copy link
Contributor Author

@hjelmn can you please have a look at this ?

the first three commits help evidence the issue reported in #6524
the last one is an attempt to fix it, but it does not work.
Even if the logic is correct, it does not work because mca_rcache_base_vma_delete() does not delete anything, and we end up using a release'd object

@hjelmn
Copy link
Member

hjelmn commented Apr 1, 2019

I think we found the root cause for the bug. Will double-check and see if the patch can be pushed this week.

@jsquyres
Copy link
Member

jsquyres commented Apr 9, 2019

@hjelmn Any update?

Is this related to the v4.0 PR #6550?

@AboorvaDevarajan
Copy link
Member

Can one of the admins verify this patch?

@gpaulsen
Copy link
Member

@hjelmn @ggouaillardet Hello. Do either of you have an update on this PR? Thanks.

@sekifjikkatsu
Copy link

Is issue of [#7030] same problem?

@sekifjikkatsu
Copy link

sekifjikkatsu commented Dec 24, 2019

I think that correction #7030 is valid for this problem.
But I think that OBJ_CHECK is not needed.
If mca_btl_vader_endpoint_xpmem_rcache_cleanup is called twice or more by reg which is same address,
OBJ_CHECK detects assertion error.

if reg to be released is which has condition reg->alloc_base == ep->peer_smp_ran,
OBJ_CHECK should be executed if reg->alloc_base == ep->peer_smp_rank is true?(instead of assert checking at OBJ_RELEASE.)

However, reg is append to the list just only one time by following process,
if (0 == OPAL_THREAD_FETCH_ADD32(&reg->ref_count, -1)) {
I think it seems correct.

Reg is freed just once in the OPAL_LIST_FOREACH_SAFE loop at mca_btl_vader_xpmem_cleanup_endpoint layer.

--- a/opal/mca/btl/vader/btl_vader_xpmem.c
+++ b/opal/mca/btl/vader/btl_vader_xpmem.c
@@ -154,10 +154,20 @@ mca_rcache_base_registration_t *vader_get_registation (struct mca_btl_base_endpo
 static int mca_btl_vader_endpoint_xpmem_rcache_cleanup (mca_rcache_base_registration_t *reg, void *ctx)
 {
     mca_btl_vader_endpoint_t *ep = (mca_btl_vader_endpoint_t *) ctx;
+#if OPAL_ENABLE_DEBUG
+fprintf(stderr,"SEKI %s ep=%lx reg=%lx alloc_base=%ld peer_smp_rank=%ld ref_count=%d obj_magic_id=%d/%d flag=%x/%x \n",__func__,ep,reg,(intptr_t)reg->alloc_base,ep->peer_smp_rank,reg->ref_count,((opal_object_t *)(reg))->obj_magic_id,OPAL_OBJ_MAGIC_ID,reg->flags,MCA_RCACHE_FLAGS_PERSIST);fflush(stderr);
+fflush(stderr);
+#endif
     if ((intptr_t) reg->alloc_base == ep->peer_smp_rank) {
         /* otherwise dereg will fail on assert */
-        reg->ref_count = 0;
-        OBJ_RELEASE(reg);
+        OBJ_CHECK(reg);
+        if (0 == OPAL_THREAD_FETCH_ADD32(&reg->ref_count, -1)) {
+#if OPAL_ENABLE_DEBUG
+fprintf(stderr,"SEKI %s ep=%lx reg=%lx alloc_base=%ld peer_smp_rank=%ld ref_count=%d obj_magic_id=%d/%d flag=%x/%x APPEND \n",__func__,ep,reg,(intptr_t)reg->alloc_base,ep->peer_smp_rank,reg->ref_count,((opal_object_t *)(reg))->obj_magic_id,OPAL_OBJ_MAGIC_ID,reg->flags,MCA_RCACHE_FLAGS_PERSIST);fflush(stderr);
+fflush(stderr);
+#endif
+            opal_list_append(&ep->regs, &reg->super.super);
+        }
     }

@sekifjikkatsu
Copy link

some bugs may be still.
I tried to modifiy as folllows but IMB-MPI1 does not terminate normally.

     if ((intptr_t) reg->alloc_base == ep->peer_smp_rank) {
         /* otherwise dereg will fail on assert */
-        reg->ref_count = 0;
-        OBJ_RELEASE(reg);
+        int32_t ref_count;
+        ref_count = opal_atomic_add_fetch_32 (&reg->ref_count, -1);
+        if (0 == ref_count) {
+            OBJ_CHECK(reg);
+            opal_list_append(&ep->regs, &reg->super.super);
+        }
     }

@jsquyres
Copy link
Member

@hjelmn Ping.

@sekifjikkatsu
Copy link

Assertion error of Magic id is reproduced in the return_registration called from the MPI_Reduce_scatter.

IMB-MPI1: /home/seki/FX1000/Jikki/MPI/src/4.0.1/xpmem6534/fjmpi/opal/mca/btl/vader/btl_vader_xpmem.c:74: void vader_return_registration(mca_rcache_base_registration_t *, struct mca_btl_base_endpoint_t *): Assertion `OPAL_OBJ_MAGIC_ID == ((opal_object_t *) (reg))->obj_magic_id' failed.
[system2-cn00:00064] *** Process received signal ***
[system2-cn00:00064] Signal: Aborted (6)
[system2-cn00:00064] Signal code:  (-6)
[system2-cn00:00064] [ 0] linux-vdso.so.1(__kernel_rt_sigreturn+0x0)[0x40000005066c]
[system2-cn00:00064] [ 1] /lib64/libc.so.6(gsignal+0xac)[0x400001062dbc]
[system2-cn00:00064] [ 2] /lib64/libc.so.6(abort+0x110)[0x400001050928]
[system2-cn00:00064] [ 3] /lib64/libc.so.6(+0x2c460)[0x40000105c460]
[system2-cn00:00064] [ 4] /lib64/libc.so.6(__assert_perror_fail+0x0)[0x40000105c4c8]
[system2-cn00:00064] [ 5] /fefs01/mpi/seki/intratest/fjmpi-191224/lib64/libmpi.so.0(vader_return_registration+0x13c)[0x4000006f4434]
[system2-cn00:00064] [ 6] /fefs01/mpi/seki/intratest/fjmpi-191224/lib64/libmpi.so.0(mca_btl_vader_get_xpmem+0xec)[0x4000006ebe00]
[system2-cn00:00064] [ 7] /fefs01/mpi/seki/intratest/fjmpi-191224/lib64/libmpi.so.0(+0x48f0e4)[0x4000004ef0e4]
[system2-cn00:00064] [ 8] /fefs01/mpi/seki/intratest/fjmpi-191224/lib64/libmpi.so.0(mca_pml_ob1_recv_request_get_frag+0x18c)[0x4000004eecbc]
[system2-cn00:00064] [ 9] /fefs01/mpi/seki/intratest/fjmpi-191224/lib64/libmpi.so.0(mca_pml_ob1_recv_request_progress_rget+0x530)[0x4000004efd54]

[system2-cn00:00064] [24] /fefs01/mpi/seki/intratest/fjmpi-191224/lib64/libmpi.so.0(PMPI_Reduce_scatter+0x40)[0x40000020de90]

@hjelmn
Copy link
Member

hjelmn commented Dec 26, 2019

I need to take a closer look at the issue to determine what the appropriate fix is. Can do that this week.

@sekifjikkatsu
Copy link

SIGSEGV is reproduced too.

[system2-cn08:00105] *** Process received signal ***
[system2-cn08:00105] Signal: Segmentation fault (11)
[system2-cn08:00105] Signal code: Address not mapped (1)
[system2-cn08:00105] Failing at address: 0x400003ec8fa0
(gdb) where
#0  0x0000400000344138 in __memcpy_generic () from /lib64/libc.so.6
#1  0x000040000232bd64 in vader_memmove (dst=0xa2a150, src=0x400003ec8fa0, size=131072) at ../../../../../opal/mca/btl/vader/btl_vader.h:188
#2  0x000040000232c2ac in mca_btl_vader_get_xpmem (btl=0x400002350250 <mca_btl_vader>, endpoint=0x5aa420, local_address=0xa2a150, remote_address=10325920, local_handle=0x0,
    remote_handle=0x5a22e8, size=131072, flags=0, order=255, cbfunc=0x4000035ac788 <mca_pml_ob1_rget_completion>, cbcontext=0x5bb110, cbdata=0x5a2200)
    at ../../../../../opal/mca/btl/vader/btl_vader_get.c:57
#3  0x00004000035aad20 in mca_bml_base_get (bml_btl=0x5bb110, local_address=0xa2a150, remote_address=10325920, local_handle=0x0, remote_handle=0x5a22e8, size=131072, flags=0, order=255,
    cbfunc=0x4000035ac788 <mca_pml_ob1_rget_completion>, cbdata=0x5a2200) at ../../../../../ompi/mca/bml/bml.h:326
#4  0x00004000035acc64 in mca_pml_ob1_recv_request_get_frag (frag=0x5a2200) at ../../../../../ompi/mca/pml/ob1/pml_ob1_recvreq.c:492
#5  0x00004000035ad22c in mca_pml_ob1_recv_request_progress_rget (recvreq=0x5a5480, btl=0x400002350250 <mca_btl_vader>, segments=0xffffffffd690, num_segments=1)
    at ../../../../../ompi/mca/pml/ob1/pml_ob1_recvreq.c:786
#6  0x00004000035a8d14 in mca_pml_ob1_recv_frag_match_proc (btl=0x400002350250 <mca_btl_vader>, comm_ptr=0x47ef70, proc=0x5bf3e0, hdr=0x4000296efa30, segments=0xffffffffd690,
    num_segments=1, type=67, frag=0x0) at ../../../../../ompi/mca/pml/ob1/pml_ob1_recvfrag.c:1012
#7  0x00004000035a8bcc in mca_pml_ob1_recv_frag_match (btl=0x400002350250 <mca_btl_vader>, hdr=0x4000296efa30, segments=0xffffffffd690, num_segments=1, type=67)
    at ../../../../../ompi/mca/pml/ob1/pml_ob1_recvfrag.c:946
#8  0x00004000035a7cfc in mca_pml_ob1_recv_frag_callback_rget (btl=0x400002350250 <mca_btl_vader>, tag=67 'C', des=0xffffffffd608, cbdata=0x0)
    at ../../../../../ompi/mca/pml/ob1/pml_ob1_recvfrag.c:532
#9  0x0000400002328ef8 in mca_btl_vader_poll_handle_frag (hdr=0x4000296efa00, endpoint=0x5aa420) at ../../../../../opal/mca/btl/vader/btl_vader_component.c:663
#10 0x0000400002326988 in mca_btl_vader_check_fboxes () at ../../../../../opal/mca/btl/vader/btl_vader_fbox.h:231
#11 0x00004000023292a8 in mca_btl_vader_component_progress () at ../../../../../opal/mca/btl/vader/btl_vader_component.c:762
#12 0x00004000005b7dcc in opal_progress () at ../../opal/runtime/opal_progress.c:231
#13 0x000040000359ff1c in ompi_request_wait_completion (req=0x5a4c00) at ../../../../../ompi/request/request.h:415
#14 0x00004000035a22e0 in mca_pml_ob1_send (buf=0x9ea130, count=32768, datatype=0x4320c0 <ompi_mpi_float>, dst=28, tag=-22, sendmode=MCA_PML_BASE_SEND_STANDARD, comm=0x47ef70)
    at ../../../../../ompi/mca/pml/ob1/pml_ob1_isend.c:280
#15 0x0000400000186e34 in ompi_coll_base_reduce_scatter_intra_ring (sbuf=0x4000308e0010, rbuf=0x40002fec0010, rcounts=0x5ca4c0, dtype=0x4320c0 <ompi_mpi_float>,
    op=0x4304c0 <ompi_mpi_op_sum>, comm=0x47ef70, module=0x5f7940) at ../../../../ompi/mca/coll/base/coll_base_reduce_scatter.c:588
#16 0x0000400003696328 in ompi_coll_tuned_reduce_scatter_intra_dec_fixed (sbuf=0x4000308e0010, rbuf=0x40002fec0010, rcounts=0x5ca4c0, dtype=0x4320c0 <ompi_mpi_float>,
    op=0x4304c0 <ompi_mpi_op_sum>, comm=0x47ef70, module=0x5f7940) at ../../../../../ompi/mca/coll/tuned/coll_tuned_decision_fixed.c:508
#17 0x0000400000131bb4 in PMPI_Reduce_scatter (sendbuf=0x4000308e0010, recvbuf=0x40002fec0010, recvcounts=0x5ca4c0, datatype=0x4320c0 <ompi_mpi_float>, op=0x4304c0 <ompi_mpi_op_sum>,
    comm=0x47ef70) at preduce_scatter.c:134
#18 0x0000000000409360 in IMB_reduce_scatter ()
#19 0x0000000000405428 in IMB_init_buffers_iter ()
#20 0x0000000000402118 in main ()

@sekifjikkatsu
Copy link

Something may be destroied after xpmem_detach,OBJ_RELEASE (reg) in the vader_return_registration?
Magic id is wrong in the mca_btl_vader_get_xpmem.

SEKI vader_return_registration ep=31d7740 reg=329afb0 rcache_context=40000aeb0000 XPMEM_DETACH OBJ_RELEASE
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=97 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=96 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=96 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=95 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=95 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=94 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=94 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=93 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=93 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=92 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=92 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=91 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=91 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=90 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=90 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=89 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=89 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=88 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=88 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=87 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=87 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=86 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=86 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=85 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=85 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=84 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=84 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=83 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=83 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=82 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=82 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=81 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=81 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=80 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=80 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=79 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=79 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=78 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=2 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4800001/4400001 ref_count=78 magic=3e00000/deafbeed PASS-1
SEKI vader_return_registration ep=31d7740 reg=329afb0 ref_count=77 flags=0/2 magic=3e00000/deafbeed
SEKI vader_get_registation ep=31d7740 reg=329afb0 rc=1 rem_ptr=3ec9d10 base=3e00000/3e00000 bound=4000001/4400001 ref_count=146 magic=3e00000/deafbeed PASS-1
SEKI vader_get_registation ep=31d7740 reg=329afb0 rcache_context=0 rem_ptr=3ec9d10 base=3e00000 ref_count=146 magic=3e00000/deafbeed
SEKI mca_btl_vader_get_xpmem reg=329afb0 local_address=3eb8a70 remote_address=3ec9d10 rem_ptr=c9d10 size=131072 magic=3e00000/deafbeed

@sekifjikkatsu
Copy link

sekifjikkatsu commented Jan 6, 2020

There is a case that reg->rcache_context value is NULL at end of the vader_get_registation.
I think that it casue segmentation fault in the mca_btl_vader_get_xpmem.
reg=36a0e80 seems be already released by the vader_return_registration.
Does the mca_rcache_base_vma_iterate return freed reg? and is it correct?

    mca_rcache_base_registration_t *reg = NULL;
    vader_check_reg_ctx_t check_ctx = {.ep = ep, .reg = &reg};
    rc = mca_rcache_base_vma_iterate (vma_module, (void *) base, bound - base, true, vader_check_reg, &check_ctx);
SEKI vader_return_registration ep=35dd670 reg=36a0e80 OBJ_RELEASE
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=4000015f4810
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=2 ep=35dd670 reg=36a0e80 rcache_context=36a5700
SEKI vader_get_registation rc=1 ep=35dd670 reg=36a0e80 rcache_context=0
SEKI vader_get_registation ep=35dd670 reg=36a0e80 local_ptr=ce3d0 rcache_context=0 [bound=4400001 - base=4200000]=200001 [rem_ptr=42ce3d0 - base=4200000]=ce3d0

@hjelmn
Copy link
Member

hjelmn commented Jan 6, 2020

Planning to look at this today.

@hjelmn
Copy link
Member

hjelmn commented Jan 7, 2020

Still looking. Would be easier if this reproduced in a small VM.

@hjelmn
Copy link
Member

hjelmn commented Jan 7, 2020

Hah. I see the issue. Do not know how that bug went undetected for as long as it did. Fix incoming.

@hjelmn
Copy link
Member

hjelmn commented Jan 8, 2020

@hppritcha Long story short. opal_interval_tree_t does not like it when multiple nodes have the same high and low values (which increases in likelihood with increased ppn). This is a design choice that is ok for the rcache usage but not the vader usage. I am working on a fix. There are additional minor bugs in vader but the opal_interval_tree_t one is what is triggering the crash at finalize. Should have the PRs up today or tomorrow.

hjelmn added a commit to hjelmn/ompi that referenced this pull request Jan 8, 2020
This commit fixes an issue discovered in the XPMEM registration cache. It
was possible for a registration to be invalidated by multiple threads
leading to a double-free situation or re-use of an invalidated registration.

This commit fixes the issue by setting the INVALID flag on a registation
when it will be deleted. The flag is set while iterating over the tree
to take advantage of the fact that a registration can not be removed
from the VMA tree by a thread while another thread is traversing the VMA
tree.

References open-mpi#6524
References open-mpi#7030
Closes open-mpi#6534

Signed-off-by: Nathan Hjelm <hjelmn@google.com>
@hjelmn hjelmn closed this in f86f805 Jan 14, 2020
hppritcha pushed a commit to hppritcha/ompi that referenced this pull request Jan 19, 2020
This commit fixes an issue discovered in the XPMEM registration cache. It
was possible for a registration to be invalidated by multiple threads
leading to a double-free situation or re-use of an invalidated registration.

This commit fixes the issue by setting the INVALID flag on a registation
when it will be deleted. The flag is set while iterating over the tree
to take advantage of the fact that a registration can not be removed
from the VMA tree by a thread while another thread is traversing the VMA
tree.

References open-mpi#6524
References open-mpi#7030
Closes open-mpi#6534

Signed-off-by: Nathan Hjelm <hjelmn@google.com>
(cherry picked from commit f86f805)
cniethammer pushed a commit to cniethammer/ompi that referenced this pull request May 10, 2020
This commit fixes an issue discovered in the XPMEM registration cache. It
was possible for a registration to be invalidated by multiple threads
leading to a double-free situation or re-use of an invalidated registration.

This commit fixes the issue by setting the INVALID flag on a registation
when it will be deleted. The flag is set while iterating over the tree
to take advantage of the fact that a registration can not be removed
from the VMA tree by a thread while another thread is traversing the VMA
tree.

References open-mpi#6524
References open-mpi#7030
Closes open-mpi#6534

Signed-off-by: Nathan Hjelm <hjelmn@google.com>
(cherry picked from commit f86f805)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants