All of lore.kernel.org
 help / color / mirror / Atom feed
* [RFC][PATCH v3 00/33] timers: Use timer_shutdown*() before freeing timers
@ 2022-11-04  5:40 ` Steven Rostedt
  0 siblings, 0 replies; 134+ messages in thread
From: Steven Rostedt @ 2022-11-04  5:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Linus Torvalds, Thomas Gleixner, Stephen Boyd, Guenter Roeck,
	Anna-Maria Gleixner, Andrew Morton, rcu, linux-doc, linux-kernel,
	linux-s390, linux-sh, linux-edac, cgroups, linux-block,
	linux-acpi, linux-atm-general, netdev, linux-pm, drbd-dev,
	linux-bluetooth, openipmi-developer, linux-media, dri-devel,
	linaro-mm-sig, intel-gfx, linux-input, linux-parisc, linux-leds,
	intel-wired-lan, linux-usb, linux-wireless, linux-scsi,
	linux-staging, linux-ext4, linux-nilfs, bridge, netfilter-devel,
	coreteam, lvs-devel, linux-afs, linux-nfs, tipc-discussion,
	alsa-devel


Back in April, I posted an RFC patch set to help mitigate a common issue
where a timer gets armed just before it is freed, and when the timer
goes off, it crashes in the timer code without any evidence of who the
culprit was. I got side tracked and never finished up on that patch set.
Since this type of crash is still our #1 crash we are seeing in the field,
it has become a priority again to finish it.

This is v3 of that patch set. Thomas Gleixner posted an untested version
that makes timer->function NULL as the flag that it is shutdown. I took that
code, tested it (fixed it up), added more comments, and changed the
name to timer_shutdown_sync(). I also converted it to use WARN_ON_ONCE()
instead of just WARN_ON() as Linus asked for.

I then created a trivial coccinelle script to find where del_timer*()
is called before being freed, and converted them all to timer_shutdown*()
(There was a couple that still used del_timer() instead of del_timer_sync()).

I also updated DEBUG_OBJECTS_TIMERS to check from where the timer is ever
armed, to calling of timer_shutdown_sync(), and it will trigger if a timer
is freed in between. The current way is to only check if the timer is armed,
but that means it only triggers if the race condition is hit, and with
experience, it's not run on enough machines to catch all of them. By triggering
it from the time the timer is armed to the time it is shutdown, it catches
all potential cases even if the race condition is not hit.

I went though the result of the cocinelle script, and updated the locations.
Some locations were caught by DEBUG_OBJECTS_TIMERS as the coccinelle script
only checked for timers being freed in the same function as the del_timer*().

Ideally, I would have the first patch go into this rc cycle, which is mostly
non functional as it will allow the other patches to come in via the respective
subsystems in the next merge window.

Changes since v2: https://lore.kernel.org/all/20221027150525.753064657@goodmis.org/

 - Talking with Thomas Gleixner, he wanted a better name space and to remove
   the "del_" portion of the API.

 - Since there's now a shutdown interface that does not synchronize, to keep
   it closer to del_timer() and del_timer_sync(), the API is now:

    timer_shutdown() - same as del_timer() but deactivates the timer.

    timer_shutdown_sync() - same as del_timer_sync() but deactivates the timer.

 - Added a few more locations that got converted.

  git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace/timers

Head SHA1: 25106f0bb7968b3e8c746a7853f44b51840746c3


Steven Rostedt (Google) (33):
      timers: Add timer_shutdown_sync() and timer_shutdown() to be called before freeing timers
      timers: s390/cmm: Use timer_shutdown_sync() before freeing timer
      timers: sh: Use timer_shutdown_sync() before freeing timer
      timers: block: Use timer_shutdown_sync() before freeing timer
      timers: ACPI: Use timer_shutdown_sync() before freeing timer
      timers: atm: Use timer_shutdown_sync() before freeing timer
      timers: PM: Use timer_shutdown_sync()
      timers: Bluetooth: Use timer_shutdown_sync() before freeing timer
      timers: hangcheck: Use timer_shutdown_sync() before freeing timer
      timers: ipmi: Use timer_shutdown_sync() before freeing timer
      random: use timer_shutdown_sync() before freeing timer
      timers: dma-buf: Use timer_shutdown_sync() before freeing timer
      timers: drm: Use timer_shutdown_sync() before freeing timer
      timers: HID: Use timer_shutdown_sync() before freeing timer
      timers: Input: Use timer_shutdown_sync() before freeing timer
      timers: mISDN: Use timer_shutdown_sync() before freeing timer
      timers: leds: Use timer_shutdown_sync() before freeing timer
      timers: media: Use timer_shutdown_sync() before freeing timer
      timers: net: Use timer_shutdown_sync() before freeing timer
      timers: usb: Use timer_shutdown_sync() before freeing timer
      timers: cgroup: Use timer_shutdown_sync() before freeing timer
      timers: workqueue: Use timer_shutdown_sync() before freeing timer
      timers: nfc: pn533: Use timer_shutdown_sync() before freeing timer
      timers: pcmcia: Use timer_shutdown_sync() before freeing timer
      timers: scsi: Use timer_shutdown_sync() and timer_shutdown() before freeing timer
      timers: tty: Use timer_shutdown_sync() before freeing timer
      timers: ext4: Use timer_shutdown_sync() before freeing timer
      timers: fs/nilfs2: Use timer_shutdown_sync() before freeing timer
      timers: ALSA: Use timer_shutdown_sync() before freeing timer
      timers: jbd2: Use timer_shutdown() before freeing timer
      timers: sched/psi: Use timer_shutdown_sync() before freeing timer
      timers: x86/mce: Use __init_timer() for resetting timers
      timers: Expand DEBUG_OBJECTS_TIMER to check if it ever was used

----
 .../RCU/Design/Requirements/Requirements.rst       |   2 +-
 Documentation/core-api/local_ops.rst               |   2 +-
 Documentation/kernel-hacking/locking.rst           |   5 +
 arch/s390/mm/cmm.c                                 |   4 +-
 arch/sh/drivers/push-switch.c                      |   2 +-
 arch/x86/kernel/cpu/mce/core.c                     |  14 ++-
 block/blk-iocost.c                                 |   2 +-
 block/blk-iolatency.c                              |   2 +-
 block/blk-stat.c                                   |   2 +-
 block/blk-throttle.c                               |   2 +-
 block/kyber-iosched.c                              |   2 +-
 drivers/acpi/apei/ghes.c                           |   2 +-
 drivers/atm/idt77105.c                             |   4 +-
 drivers/atm/idt77252.c                             |   4 +-
 drivers/atm/iphase.c                               |   2 +-
 drivers/base/power/wakeup.c                        |   7 +-
 drivers/block/drbd/drbd_main.c                     |   2 +-
 drivers/block/loop.c                               |   2 +-
 drivers/block/sunvdc.c                             |   2 +-
 drivers/bluetooth/hci_bcsp.c                       |   2 +-
 drivers/bluetooth/hci_h5.c                         |   2 +-
 drivers/bluetooth/hci_qca.c                        |   4 +-
 drivers/char/hangcheck-timer.c                     |   4 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   2 +-
 drivers/char/ipmi/ipmi_ssif.c                      |   4 +-
 drivers/char/random.c                              |   2 +-
 drivers/dma-buf/st-dma-fence.c                     |   2 +-
 drivers/gpu/drm/gud/gud_pipe.c                     |   2 +-
 drivers/gpu/drm/i915/i915_sw_fence.c               |   2 +-
 drivers/hid/hid-wiimote-core.c                     |   2 +-
 drivers/input/keyboard/locomokbd.c                 |   2 +-
 drivers/input/keyboard/omap-keypad.c               |   2 +-
 drivers/input/mouse/alps.c                         |   2 +-
 drivers/input/serio/hil_mlc.c                      |   2 +-
 drivers/input/serio/hp_sdc.c                       |   2 +-
 drivers/isdn/hardware/mISDN/hfcmulti.c             |   6 +-
 drivers/isdn/mISDN/l1oip_core.c                    |   4 +-
 drivers/isdn/mISDN/timerdev.c                      |   4 +-
 drivers/leds/trigger/ledtrig-activity.c            |   2 +-
 drivers/leds/trigger/ledtrig-heartbeat.c           |   2 +-
 drivers/leds/trigger/ledtrig-pattern.c             |   2 +-
 drivers/leds/trigger/ledtrig-transient.c           |   2 +-
 drivers/media/pci/ivtv/ivtv-driver.c               |   2 +-
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c            |  18 ++--
 drivers/media/usb/s2255/s2255drv.c                 |   4 +-
 drivers/net/ethernet/intel/i40e/i40e_main.c        |   6 +-
 drivers/net/ethernet/marvell/sky2.c                |   2 +-
 drivers/net/ethernet/sun/sunvnet.c                 |   2 +-
 drivers/net/usb/sierra_net.c                       |   2 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |   2 +-
 drivers/net/wireless/intersil/hostap/hostap_ap.c   |   2 +-
 drivers/net/wireless/marvell/mwifiex/main.c        |   2 +-
 drivers/net/wireless/microchip/wilc1000/hif.c      |   8 +-
 drivers/nfc/pn533/pn533.c                          |   2 +-
 drivers/nfc/pn533/uart.c                           |   2 +-
 drivers/pcmcia/bcm63xx_pcmcia.c                    |   2 +-
 drivers/pcmcia/electra_cf.c                        |   2 +-
 drivers/pcmcia/omap_cf.c                           |   2 +-
 drivers/pcmcia/pd6729.c                            |   4 +-
 drivers/pcmcia/yenta_socket.c                      |   4 +-
 drivers/scsi/qla2xxx/qla_edif.c                    |   4 +-
 drivers/scsi/scsi_lib.c                            |   1 +
 drivers/staging/media/atomisp/i2c/atomisp-lm3554.c |   2 +-
 drivers/tty/n_gsm.c                                |   2 +-
 drivers/tty/sysrq.c                                |   2 +-
 drivers/usb/gadget/udc/m66592-udc.c                |   2 +-
 drivers/usb/serial/garmin_gps.c                    |   2 +-
 drivers/usb/serial/mos7840.c                       |   2 +-
 fs/ext4/super.c                                    |   2 +-
 fs/jbd2/journal.c                                  |   2 +
 fs/nilfs2/segment.c                                |   2 +-
 include/linux/timer.h                              | 100 +++++++++++++++++--
 include/linux/workqueue.h                          |   4 +-
 kernel/cgroup/cgroup.c                             |   2 +-
 kernel/sched/psi.c                                 |   1 +
 kernel/time/timer.c                                | 106 ++++++++++++++-------
 kernel/workqueue.c                                 |   4 +-
 net/802/garp.c                                     |   2 +-
 net/802/mrp.c                                      |   2 +-
 net/bridge/br_multicast.c                          |   6 +-
 net/bridge/br_multicast_eht.c                      |   4 +-
 net/core/gen_estimator.c                           |   2 +-
 net/core/neighbour.c                               |   2 +
 net/ipv4/inet_connection_sock.c                    |   2 +-
 net/ipv4/inet_timewait_sock.c                      |   3 +-
 net/ipv4/ipmr.c                                    |   2 +-
 net/ipv6/ip6mr.c                                   |   2 +-
 net/mac80211/mesh_pathtbl.c                        |   2 +-
 net/netfilter/ipset/ip_set_list_set.c              |   2 +-
 net/netfilter/ipvs/ip_vs_lblc.c                    |   2 +-
 net/netfilter/ipvs/ip_vs_lblcr.c                   |   2 +-
 net/netfilter/xt_LED.c                             |   2 +-
 net/rxrpc/conn_object.c                            |   2 +-
 net/sched/cls_flow.c                               |   2 +-
 net/sunrpc/svc.c                                   |   2 +-
 net/sunrpc/xprt.c                                  |   2 +-
 net/tipc/discover.c                                |   2 +-
 net/tipc/monitor.c                                 |   2 +-
 sound/i2c/other/ak4117.c                           |   2 +-
 sound/synth/emux/emux.c                            |   2 +-
 100 files changed, 310 insertions(+), 175 deletions(-)

^ permalink raw reply	[flat|nested] 134+ messages in thread

end of thread, other threads:[~2022-11-19  5:04 UTC | newest]

Thread overview: 134+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-04  5:40 [RFC][PATCH v3 00/33] timers: Use timer_shutdown*() before freeing timers Steven Rostedt
2022-11-04  5:40 ` [Bridge] " Steven Rostedt
2022-11-04  5:40 ` Steven Rostedt
2022-11-04  5:40 ` [Intel-wired-lan] " Steven Rostedt
2022-11-04  5:40 ` [Intel-gfx] " Steven Rostedt
2022-11-04  5:40 ` Steven Rostedt
2022-11-04  5:40 ` [RFC][PATCH v3 01/33] timers: Add timer_shutdown_sync() and timer_shutdown() to be called " Steven Rostedt
2022-11-04  5:40 ` [RFC][PATCH v3 02/33] timers: s390/cmm: Use timer_shutdown_sync() before freeing timer Steven Rostedt
2022-11-04  5:40 ` [RFC][PATCH v3 03/33] timers: sh: " Steven Rostedt
2022-11-04  5:40 ` [RFC][PATCH v3 04/33] timers: block: " Steven Rostedt
2022-11-04  5:56   ` Steven Rostedt
2022-11-04  5:56     ` Steven Rostedt
2022-11-04  5:40 ` [RFC][PATCH v3 05/33] timers: ACPI: " Steven Rostedt
2022-11-07 15:47   ` Jarkko Sakkinen
2022-11-04  5:40 ` [RFC][PATCH v3 06/33] timers: atm: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 07/33] timers: PM: Use timer_shutdown_sync() Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer Steven Rostedt
2022-11-04  7:18   ` timers: Use timer_shutdown*() before freeing timers bluez.test.bot
2022-11-18  3:51   ` bluez.test.bot
2022-11-18  4:38   ` bluez.test.bot
2022-11-18  5:29   ` bluez.test.bot
2022-11-18  6:34   ` bluez.test.bot
2022-11-18  7:29   ` bluez.test.bot
2022-11-18  8:33   ` bluez.test.bot
2022-11-18  9:30   ` bluez.test.bot
2022-11-19  3:56   ` bluez.test.bot
2022-11-19  5:04   ` bluez.test.bot
2022-11-04  5:41 ` [RFC][PATCH v3 09/33] timers: hangcheck: Use timer_shutdown_sync() before freeing timer Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 10/33] timers: ipmi: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 11/33] random: use " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 12/33] timers: dma-buf: Use " Steven Rostedt
2022-11-04  5:54   ` Steven Rostedt
2022-11-04  5:54     ` Steven Rostedt
2022-11-04  7:15     ` Christian König
2022-11-04  7:15       ` Christian König
2022-11-04 18:58       ` Steven Rostedt
2022-11-04 18:58         ` Steven Rostedt
2022-11-05  8:12         ` [Linaro-mm-sig] " Christian König
2022-11-05  8:12           ` Christian König
2022-11-04  5:41 ` [RFC][PATCH v3 13/33] timers: drm: " Steven Rostedt
2022-11-04  5:41   ` [Intel-gfx] " Steven Rostedt
2022-11-04  5:55   ` Steven Rostedt
2022-11-04  5:55     ` Steven Rostedt
2022-11-04  5:55     ` [Intel-gfx] " Steven Rostedt
2022-11-04  8:48   ` Tvrtko Ursulin
2022-11-04  8:48     ` [Intel-gfx] " Tvrtko Ursulin
2022-11-04  8:48     ` Tvrtko Ursulin
2022-11-04 19:02     ` Steven Rostedt
2022-11-04 19:02       ` [Intel-gfx] " Steven Rostedt
2022-11-04 19:02       ` Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 14/33] timers: HID: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 16/33] timers: mISDN: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 17/33] timers: leds: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 18/33] timers: media: " Steven Rostedt
2022-11-04  5:57   ` Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 19/33] timers: net: " Steven Rostedt
2022-11-04  5:41   ` [Bridge] " Steven Rostedt
2022-11-04  5:41   ` Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 20/33] timers: usb: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 21/33] timers: cgroup: " Steven Rostedt
2022-11-04  5:41   ` Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 22/33] timers: workqueue: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 23/33] timers: nfc: pn533: " Steven Rostedt
2022-11-04 15:46   ` Krzysztof Kozlowski
2022-11-05  5:25     ` Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 24/33] timers: pcmcia: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 25/33] timers: scsi: Use timer_shutdown_sync() and timer_shutdown() " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 26/33] timers: tty: Use timer_shutdown_sync() " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 27/33] timers: ext4: " Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 28/33] timers: fs/nilfs2: " Steven Rostedt
2022-11-04  5:41   ` Steven Rostedt
2022-11-04  6:57   ` Ryusuke Konishi
2022-11-04  6:57     ` Ryusuke Konishi
2022-11-04 18:54     ` Steven Rostedt
2022-11-04 18:54       ` Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 29/33] timers: ALSA: " Steven Rostedt
2022-11-04  5:41   ` Steven Rostedt
2022-11-04  8:11   ` Takashi Iwai
2022-11-04  8:11     ` Takashi Iwai
2022-11-04  5:41 ` [RFC][PATCH v3 30/33] timers: jbd2: Use timer_shutdown() " Steven Rostedt
2022-11-07 12:37   ` Jan Kara
2022-11-04  5:41 ` [RFC][PATCH v3 31/33] timers: sched/psi: Use timer_shutdown_sync() " Steven Rostedt
2022-11-04 20:11   ` Johannes Weiner
2022-11-04 20:29     ` Suren Baghdasaryan
2022-11-04  5:41 ` [RFC][PATCH v3 32/33] timers: x86/mce: Use __init_timer() for resetting timers Steven Rostedt
2022-11-04  5:41 ` [RFC][PATCH v3 33/33] timers: Expand DEBUG_OBJECTS_TIMER to check if it ever was used Steven Rostedt
2022-11-04 17:00 ` [RFC][PATCH v3 00/33] timers: Use timer_shutdown*() before freeing timers Linus Torvalds
2022-11-04 17:00   ` [Bridge] " Linus Torvalds
2022-11-04 17:00   ` Linus Torvalds
2022-11-04 17:00   ` Linus Torvalds
2022-11-04 17:00   ` [Intel-wired-lan] " Linus Torvalds
2022-11-04 17:00   ` [Intel-gfx] " Linus Torvalds
2022-11-04 19:22 ` Guenter Roeck
2022-11-04 19:22   ` [Bridge] " Guenter Roeck
2022-11-04 19:22   ` Guenter Roeck
2022-11-04 19:22   ` [Intel-wired-lan] " Guenter Roeck
2022-11-04 19:22   ` [Intel-gfx] " Guenter Roeck
2022-11-04 19:22   ` Guenter Roeck
2022-11-04 19:42   ` Steven Rostedt
2022-11-04 19:42     ` [Bridge] " Steven Rostedt
2022-11-04 19:42     ` Steven Rostedt
2022-11-04 19:42     ` [Intel-wired-lan] " Steven Rostedt
2022-11-04 19:42     ` [Intel-gfx] " Steven Rostedt
2022-11-04 19:42     ` Steven Rostedt
2022-11-04 19:50     ` Linus Torvalds
2022-11-04 19:50       ` [Bridge] " Linus Torvalds
2022-11-04 19:50       ` Linus Torvalds
2022-11-04 19:50       ` [Intel-wired-lan] " Linus Torvalds
2022-11-04 19:50       ` [Intel-gfx] " Linus Torvalds
2022-11-04 19:50       ` Linus Torvalds
2022-11-04 20:38     ` Steven Rostedt
2022-11-04 20:38       ` [Bridge] " Steven Rostedt
2022-11-04 20:38       ` Steven Rostedt
2022-11-04 20:38       ` [Intel-wired-lan] " Steven Rostedt
2022-11-04 20:38       ` [Intel-gfx] " Steven Rostedt
2022-11-04 20:38       ` Steven Rostedt
2022-11-04 20:42       ` Guenter Roeck
2022-11-04 20:42         ` [Bridge] " Guenter Roeck
2022-11-04 20:42         ` Guenter Roeck
2022-11-04 20:42         ` Guenter Roeck
2022-11-04 20:42         ` [Intel-wired-lan] " Guenter Roeck
2022-11-04 20:42         ` [Intel-gfx] " Guenter Roeck
2022-11-04 20:41     ` Guenter Roeck
2022-11-04 20:41       ` [Bridge] " Guenter Roeck
2022-11-04 20:41       ` Guenter Roeck
2022-11-04 20:41       ` [Intel-wired-lan] " Guenter Roeck
2022-11-04 20:41       ` [Intel-gfx] " Guenter Roeck
2022-11-04 20:41       ` Guenter Roeck
2022-11-04 23:34 ` Guenter Roeck
2022-11-04 23:34   ` [Bridge] " Guenter Roeck
2022-11-04 23:34   ` Guenter Roeck
2022-11-04 23:34   ` [Intel-wired-lan] " Guenter Roeck
2022-11-04 23:34   ` [Intel-gfx] " Guenter Roeck
2022-11-04 23:34   ` Guenter Roeck

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.