Description of problem:

SMP system may freeze, typically by frequent fork/exit.

This is a known problem which is already fixed in 2.5.32.
Patch will be attached.

This happens because there are two different order in kernel to acquire
both runqueue lock and tasklist_lock.
Thus one cpu may try to lock runqueue after tasklist_lock
and the other may try tasklist_lock after runqueue lock.


Version-Release number of selected component (if applicable):

2.4.21-3.EL


How reproducible:

difficult to reproduce.

Steps to Reproduce:
1. Running the following program on machine with many CPUs.
- - - - - - - - - - - - - - - - - - - - 
#include <unistd.h>

#define NPROC 128

int
main(int argc, char** argv)
{
        int i, status;

        for(i=1; i<NPROC; i++) {
                fork();
        }
        while (1) {
                if (fork()==0) {
                       system("exit");
                       exit(0);
                }
                else
                       wait(&status);
        }
}
- - - - - - - - - - - - - - - - - - - - 

2.
3.
    
Actual results:


Expected results:


Additional info:

IA-64 Linux kernel may call wrap_mmu_context during context_switch
to find unused context number.
wrap_mmu_context holds tasklist_lock while searching through tasklist.

On the other hand, some exit related functions grab tasklist_lock
to remove task from the list and then try to hold runqueue lock to wake
up parent.

As context_switch is called with runqueue lock held, there are two
different order to acquire tasklist_lock and runqueue lock.
This can cause dead lock.

Example:
CPU#0:
schedule()
   -> spin_lock_irq(&rq->lock)
   -> context_switch()
      -> wrap_mmu_context()
         -> read_lock(&tasklist_lock)

CPU#1:
sys_wait4()
   -> write_lock(&tasklist_lock)
   -> do_notify_parent()
      -> wake_up_parent()
         -> try_to_wake_up()
            -> spin_lock_irq(&parent_rq->lock)

The problem and fix was discussed in linux-kernel list in July, 2002.
http://marc.theaimsgroup.com/?l=linux-kernel&m=102629373819157&w=2