From: Sedat Dilek <sedat.dilek@gmail.com>
To: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Rik van Riel <riel@surriel.com>,
Andrew Morton <akpm@linux-foundation.org>,
Paul McKenney <paulmck@linux.vnet.ibm.com>,
Paul McKenney <paul.mckenney@linaro.org>,
Emmanuel Benisty <benisty.e@gmail.com>,
linux-next <linux-next@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH -next] ipc: make refcounter atomic (was Re: linux-next: Tree for Apr 23 [ Call-Traces: lib/debugobjects.c | kernel/rcupdate.c | kernel/rcutree.c ])
Date: Thu, 25 Apr 2013 01:48:21 +0200 [thread overview]
Message-ID: <CA+icZUXwfvCMhP0BJAcxNNMPuKELxav6QmN0MCfd-swRV+4g=g@mail.gmail.com> (raw)
In-Reply-To: <1366846719.1863.1.camel@buesod1.americas.hpqcorp.net>
On Thu, Apr 25, 2013 at 1:38 AM, Davidlohr Bueso <davidlohr.bueso@hp.com> wrote:
> On Thu, 2013-04-25 at 01:05 +0200, Sedat Dilek wrote:
>> On Thu, Apr 25, 2013 at 12:16 AM, Davidlohr Bueso
>> <davidlohr.bueso@hp.com> wrote:
>> > From: Davidlohr Bueso <davidlohr.bueso@hp.com>
>> >
>> > Sedat reported an issue leading to a NULL dereference in update_queue():
>> >
>> > [ 178.490583] BUG: spinlock bad magic on CPU#1, sh/8066
>> > [ 178.490595] lock: 0xffff88008b53ea18, .magic: 6b6b6b6b, .owner: make/8068, .owner_cpu: 3
>> > [ 178.490599] BUG: unable to handle kernel NULL pointer dereference at (null)
>> > [ 178.490608] IP: [<ffffffff812bacd0>] update_queue+0x70/0x210
>> > [ 178.490610] PGD 0
>> > [ 178.490612] Oops: 0000 [#1] SMP
>> > ...
>> > [ 178.490704] Call Trace:
>> > [ 178.490710] [<ffffffff812baf51>] do_smart_update+0xe1/0x140
>> > [ 178.490713] [<ffffffff812bd6e1>] exit_sem+0x2b1/0x350
>> > [ 178.490718] [<ffffffff8105de80>] do_exit+0x290/0xa70
>> > [ 178.490721] [<ffffffff8105e6f4>] do_group_exit+0x44/0xa0
>> > [ 178.490724] [<ffffffff8105e767>] SyS_exit_group+0x17/0x20
>> > [ 178.490728] [<ffffffff816ce15d>] system_call_fastpath+0x1a/0x1f
>> >
>> > Linus pin-pointed the problem to a race in the reference counter. To quote:
>> >
>> > "That dmesg spew very much implies that the same RCU head got added twice to the RCU
>> > freeing list, and the only way that happens is if the refcount goes to
>> > zero twice. Which implies that either we increment a zero, or we lack
>> > locking and the coherency of the non-atomic access goes away."
>> >
>> > This patch converts the IPC RCU header's reference counter to atomic_t. The return of
>> > ipc_rcu_getref() is modified to inform the callers if it actually succeeded.
>> >
>> > Now all callers return -EIDRM upon failure and abort the current operation. Two exceptions are
>> > in semaphore code where sem_getref_and_unlock() and sem_getref() trigger a warning but proceed
>> > to freeing up any held locks.
>> >
>> > Signed-off-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
>> > Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
>> > CC: Rik van Riel <riel@surriel.com>
>> > CC: Paul McKenney <paul.mckenney@linaro.org>
>> > CC: Sedat Dilek <sedat.dilek@gmail.com>
>> > CC: Emmanuel Benisty <benisty.e@gmail.com>
>> > CC: Andrew Morton <akpm@linux-foundation.org>
>>
>> Missing my Reported-by ...!
>
> Not trying to take away credit or efforts from you, just wanted you to
> reconfirm that *this* actual patch fixes things for you :)
>
No, I am not of those "bad guys" in OSS.
I would not have invested so much time in helping to get this fixed.
Did my usual test-case:
A kernel-rebuild within same kernel-environment with no breakage or
abnormalities in the logs.
Hope I could help.
- Sedat -
> Thanks,
> Davidlohr
>
next prev parent reply other threads:[~2013-04-24 23:48 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-23 15:49 linux-next: Tree for Apr 23 [ Call-Traces: lib/debugobjects.c | kernel/rcupdate.c | kernel/rcutree.c ] Sedat Dilek
2013-04-23 17:01 ` Paul E. McKenney
2013-04-23 17:25 ` Sedat Dilek
[not found] ` <CA+icZUXmsvbj2km=PxbAs5K+hoP+zjcXqG_wCdKR9akWF5Eucw@mail.gmail.com>
[not found] ` <CA+55aFw5J+DFgQjAdhUnhitHw+wHEmspeZP9jbyZowqNE6Nafg@mail.gmail.com>
[not found] ` <CA+icZUXHkcj_bAuPcfghZMHjRTud2jN91hjpOUiLaXd0yN9diw@mail.gmail.com>
[not found] ` <1366741069.1802.12.camel@buesod1.americas.hpqcorp.net>
[not found] ` <1366741394.1802.13.camel@buesod1.americas.hpqcorp.net>
[not found] ` <CA+icZUV48SZeNt4GRKi8yDKbsO_c7ApUOgb4mRX67=d_ridE8w@mail.gmail.com>
[not found] ` <CA+55aFxh_-3BSBXrm8j1-3bN_oLLA66ApykRcfFFKRvrb6MDkQ@mail.gmail.com>
2013-04-24 22:16 ` [PATCH -next] ipc: make refcounter atomic (was Re: linux-next: Tree for Apr 23 [ Call-Traces: lib/debugobjects.c | kernel/rcupdate.c | kernel/rcutree.c ]) Davidlohr Bueso
2013-04-24 23:05 ` Sedat Dilek
2013-04-24 23:38 ` Davidlohr Bueso
2013-04-24 23:48 ` Sedat Dilek [this message]
2013-04-25 12:56 ` Rik van Riel
2013-04-25 13:14 ` Emmanuel Benisty
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CA+icZUXwfvCMhP0BJAcxNNMPuKELxav6QmN0MCfd-swRV+4g=g@mail.gmail.com' \
--to=sedat.dilek@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=benisty.e@gmail.com \
--cc=davidlohr.bueso@hp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=paul.mckenney@linaro.org \
--cc=paulmck@linux.vnet.ibm.com \
--cc=riel@surriel.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).