[PATCH 0/2] of: unittest gpio unittest error exposes tracking error

[PATCH 0/2] of: unittest gpio unittest error exposes tracking error

[frowand.list]

From: Frank Rowand <frank.rowand@sony.com>

kernel test robot reported "WARNING: held lock freed!" triggered by
unittest_gpio_remove().

This warning is from a bad kfree() call from an unexpected call to
unittest_gpio_remove().  The unexpected call is due to an error
with unittest overlay tracking.

Patch 1/2 fixes the kfree bug.

Patch 2/2 fixes the unittest overlay tracking bug.

Frank Rowand (2):
  of: gpio unittest kfree() wrong object
  of: some unittest overlays not untracked

 drivers/of/unittest.c | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

-- 
Frank Rowand <frank.rowand@sony.com>

[PATCH 1/2] of: gpio unittest kfree() wrong object

[frowand.list]

From: Frank Rowand <frank.rowand@sony.com>

kernel test robot reported "WARNING: held lock freed!" triggered by
unittest_gpio_remove().  unittest_gpio_remove() was unexpectedly
called due to an error in overlay tracking.  The remove had not
been tested because the gpio overlay removal tests have not been
implemented.

kfree() gdev instead of pdev.

Fixes: f4056e705b2e ("of: unittest: add overlay gpio test to catch gpio hog problem")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
---
 drivers/of/unittest.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 96ae8a762a9e..25911ad1ce99 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -122,7 +122,7 @@ static int unittest_gpio_remove(struct platform_device *pdev)
 		gpiochip_remove(&gdev->chip);
 
 	platform_set_drvdata(pdev, NULL);
-	kfree(pdev);
+	kfree(gdev);
 
 	return 0;
 }
-- 
Frank Rowand <frank.rowand@sony.com>

Re: [PATCH 1/2] of: gpio unittest kfree() wrong object

[Geert Uytterhoeven]

On Thu, Mar 26, 2020 at 2:47 AM <frowand.list@gmail.com> wrote:
> From: Frank Rowand <frank.rowand@sony.com>
>
> kernel test robot reported "WARNING: held lock freed!" triggered by
> unittest_gpio_remove().  unittest_gpio_remove() was unexpectedly
> called due to an error in overlay tracking.  The remove had not
> been tested because the gpio overlay removal tests have not been
> implemented.
>
> kfree() gdev instead of pdev.
>
> Fixes: f4056e705b2e ("of: unittest: add overlay gpio test to catch gpio hog problem")
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Frank Rowand <frank.rowand@sony.com>

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH 1/2] of: gpio unittest kfree() wrong object

[Rob Herring]

On Wed, 25 Mar 2020 20:45:30 -0500, frowand.list@gmail.com wrote:
> From: Frank Rowand <frank.rowand@sony.com>
> 
> kernel test robot reported "WARNING: held lock freed!" triggered by
> unittest_gpio_remove().  unittest_gpio_remove() was unexpectedly
> called due to an error in overlay tracking.  The remove had not
> been tested because the gpio overlay removal tests have not been
> implemented.
> 
> kfree() gdev instead of pdev.
> 
> Fixes: f4056e705b2e ("of: unittest: add overlay gpio test to catch gpio hog problem")
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Frank Rowand <frank.rowand@sony.com>
> ---
>  drivers/of/unittest.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Applied, thanks.

Rob

[PATCH 2/2] of: some unittest overlays not untracked

[frowand.list]

From: Frank Rowand <frank.rowand@sony.com>

kernel test robot reported "WARNING: held lock freed!" triggered by
unittest_gpio_remove(), which should not have been called because
the related gpio overlay was not tracked.  Another overlay that
was tracked had previously used the same id as the gpio overlay
but had not been untracked when the overlay was removed.  Thus the
clean up function of_unittest_destroy_tracked_overlays() incorrectly
attempted to remove the reused overlay id.

Patch contents:

  - Create tracking related helper functions
  - Change BUG() to WARN_ON() for overlay id related issues
  - Add some additional error checking for valid overlay id values
  - Add the missing overlay untrack
  - update comment on expectation that overlay ids are assigned in
    sequence

Fixes: 492a22aceb75 ("of: unittest: overlay: Keep track of created overlays")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
---
 drivers/of/unittest.c | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 25911ad1ce99..27f538f859a6 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -1689,19 +1689,27 @@ static const char *overlay_name_from_nr(int nr)
 
 static const char *bus_path = "/testcase-data/overlay-node/test-bus";
 
-/* it is guaranteed that overlay ids are assigned in sequence */
+/* FIXME: it is NOT guaranteed that overlay ids are assigned in sequence */
+
 #define MAX_UNITTEST_OVERLAYS	256
 static unsigned long overlay_id_bits[BITS_TO_LONGS(MAX_UNITTEST_OVERLAYS)];
 static int overlay_first_id = -1;
 
+static long of_unittest_overlay_tracked(int id)
+{
+	if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
+		return 0;
+	return overlay_id_bits[BIT_WORD(id)] & BIT_MASK(id);
+}
+
 static void of_unittest_track_overlay(int id)
 {
 	if (overlay_first_id < 0)
 		overlay_first_id = id;
 	id -= overlay_first_id;
 
-	/* we shouldn't need that many */
-	BUG_ON(id >= MAX_UNITTEST_OVERLAYS);
+	if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
+		return;
 	overlay_id_bits[BIT_WORD(id)] |= BIT_MASK(id);
 }
 
@@ -1710,7 +1718,8 @@ static void of_unittest_untrack_overlay(int id)
 	if (overlay_first_id < 0)
 		return;
 	id -= overlay_first_id;
-	BUG_ON(id >= MAX_UNITTEST_OVERLAYS);
+	if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
+		return;
 	overlay_id_bits[BIT_WORD(id)] &= ~BIT_MASK(id);
 }
 
@@ -1726,7 +1735,7 @@ static void of_unittest_destroy_tracked_overlays(void)
 		defers = 0;
 		/* remove in reverse order */
 		for (id = MAX_UNITTEST_OVERLAYS - 1; id >= 0; id--) {
-			if (!(overlay_id_bits[BIT_WORD(id)] & BIT_MASK(id)))
+			if (!of_unittest_overlay_tracked(id))
 				continue;
 
 			ovcs_id = id + overlay_first_id;
@@ -1743,7 +1752,7 @@ static void of_unittest_destroy_tracked_overlays(void)
 				continue;
 			}
 
-			overlay_id_bits[BIT_WORD(id)] &= ~BIT_MASK(id);
+			of_unittest_untrack_overlay(id);
 		}
 	} while (defers > 0);
 }
@@ -1804,7 +1813,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr,
 		int unittest_nr, int before, int after,
 		enum overlay_type ovtype)
 {
-	int ret, ovcs_id;
+	int ret, ovcs_id, save_id;
 
 	/* unittest device must be in before state */
 	if (of_unittest_device_exists(unittest_nr, ovtype) != before) {
@@ -1832,6 +1841,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr,
 		return -EINVAL;
 	}
 
+	save_id = ovcs_id;
 	ret = of_overlay_remove(&ovcs_id);
 	if (ret != 0) {
 		unittest(0, "%s failed to be destroyed @\"%s\"\n",
@@ -1839,6 +1849,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr,
 				unittest_path(unittest_nr, ovtype));
 		return ret;
 	}
+	of_unittest_untrack_overlay(save_id);
 
 	/* unittest device must be again in before state */
 	if (of_unittest_device_exists(unittest_nr, PDEV_OVERLAY) != before) {
@@ -2528,6 +2539,11 @@ static void __init of_unittest_overlay_gpio(void)
 	 * Similar to installing a driver as a module, the
 	 * driver is registered after applying the overlays.
 	 *
+	 * The overlays are applied by overlay_data_apply()
+	 * instead of of_unittest_apply_overlay() so that they
+	 * will not be tracked.  Thus they will not be removed
+	 * by of_unittest_destroy_tracked_overlays().
+	 *
 	 * - apply overlay_gpio_01
 	 * - apply overlay_gpio_02a
 	 * - apply overlay_gpio_02b
-- 
Frank Rowand <frank.rowand@sony.com>

Re: [PATCH 2/2] of: some unittest overlays not untracked

[Geert Uytterhoeven]

Hi Frank,

On Thu, Mar 26, 2020 at 2:47 AM <frowand.list@gmail.com> wrote:
> From: Frank Rowand <frank.rowand@sony.com>
>
> kernel test robot reported "WARNING: held lock freed!" triggered by
> unittest_gpio_remove(), which should not have been called because
> the related gpio overlay was not tracked.  Another overlay that
> was tracked had previously used the same id as the gpio overlay
> but had not been untracked when the overlay was removed.  Thus the
> clean up function of_unittest_destroy_tracked_overlays() incorrectly
> attempted to remove the reused overlay id.
>
> Patch contents:
>
>   - Create tracking related helper functions
>   - Change BUG() to WARN_ON() for overlay id related issues
>   - Add some additional error checking for valid overlay id values
>   - Add the missing overlay untrack
>   - update comment on expectation that overlay ids are assigned in
>     sequence
>
> Fixes: 492a22aceb75 ("of: unittest: overlay: Keep track of created overlays")
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Frank Rowand <frank.rowand@sony.com>

Looks good to me, so:
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Still, a few suggestions for future improvement below...

> --- a/drivers/of/unittest.c
> +++ b/drivers/of/unittest.c
> @@ -1689,19 +1689,27 @@ static const char *overlay_name_from_nr(int nr)
>
>  static const char *bus_path = "/testcase-data/overlay-node/test-bus";
>
> -/* it is guaranteed that overlay ids are assigned in sequence */
> +/* FIXME: it is NOT guaranteed that overlay ids are assigned in sequence */
> +
>  #define MAX_UNITTEST_OVERLAYS  256
>  static unsigned long overlay_id_bits[BITS_TO_LONGS(MAX_UNITTEST_OVERLAYS)];

Obviously this should have used DECLARE_BITMAP() ;-)

>  static int overlay_first_id = -1;
>
> +static long of_unittest_overlay_tracked(int id)
> +{
> +       if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
> +               return 0;

Do we need all these checks on id? Can this really happen?
I guess doing it once in of_unittest_track_overlay(), and aborting all
of_unittests if it triggers should be sufficient?

> +       return overlay_id_bits[BIT_WORD(id)] & BIT_MASK(id);

No need for BIT_{WORD,MASK}() calculations if you would use test_bit().

> +}
> +
>  static void of_unittest_track_overlay(int id)
>  {
>         if (overlay_first_id < 0)
>                 overlay_first_id = id;
>         id -= overlay_first_id;
>
> -       /* we shouldn't need that many */
> -       BUG_ON(id >= MAX_UNITTEST_OVERLAYS);
> +       if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
> +               return;
>         overlay_id_bits[BIT_WORD(id)] |= BIT_MASK(id);

set_bit()

>  }
>
> @@ -1710,7 +1718,8 @@ static void of_unittest_untrack_overlay(int id)
>         if (overlay_first_id < 0)
>                 return;
>         id -= overlay_first_id;
> -       BUG_ON(id >= MAX_UNITTEST_OVERLAYS);
> +       if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
> +               return;
>         overlay_id_bits[BIT_WORD(id)] &= ~BIT_MASK(id);

clear_bit()

>  }
>
> @@ -1726,7 +1735,7 @@ static void of_unittest_destroy_tracked_overlays(void)
>                 defers = 0;
>                 /* remove in reverse order */

If it is not guaranteed that overlay ids are assigned in sequence, the
reverse order is not really needed, so you could replace the bitmap and
your own tracking mechanism by DEFINE_IDR() and idr_for_each()?
And as IDRs are flexible, MAX_UNITTEST_OVERLAYS and all checks
could be removed, too.

>                 for (id = MAX_UNITTEST_OVERLAYS - 1; id >= 0; id--) {
> -                       if (!(overlay_id_bits[BIT_WORD(id)] & BIT_MASK(id)))
> +                       if (!of_unittest_overlay_tracked(id))
>                                 continue;
>
>                         ovcs_id = id + overlay_first_id;
> @@ -1743,7 +1752,7 @@ static void of_unittest_destroy_tracked_overlays(void)
>                                 continue;
>                         }
>
> -                       overlay_id_bits[BIT_WORD(id)] &= ~BIT_MASK(id);
> +                       of_unittest_untrack_overlay(id);
>                 }
>         } while (defers > 0);
>  }

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH 2/2] of: some unittest overlays not untracked

[Frank Rowand]

On 3/26/20 3:21 AM, Geert Uytterhoeven wrote:
> Hi Frank,
> 
> On Thu, Mar 26, 2020 at 2:47 AM <frowand.list@gmail.com> wrote:
>> From: Frank Rowand <frank.rowand@sony.com>
>>
>> kernel test robot reported "WARNING: held lock freed!" triggered by
>> unittest_gpio_remove(), which should not have been called because
>> the related gpio overlay was not tracked.  Another overlay that
>> was tracked had previously used the same id as the gpio overlay
>> but had not been untracked when the overlay was removed.  Thus the
>> clean up function of_unittest_destroy_tracked_overlays() incorrectly
>> attempted to remove the reused overlay id.
>>
>> Patch contents:
>>
>>   - Create tracking related helper functions
>>   - Change BUG() to WARN_ON() for overlay id related issues
>>   - Add some additional error checking for valid overlay id values
>>   - Add the missing overlay untrack
>>   - update comment on expectation that overlay ids are assigned in
>>     sequence
>>
>> Fixes: 492a22aceb75 ("of: unittest: overlay: Keep track of created overlays")
>> Reported-by: kernel test robot <lkp@intel.com>
>> Signed-off-by: Frank Rowand <frank.rowand@sony.com>
> 
> Looks good to me, so:
> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
> 
> Still, a few suggestions for future improvement below...
> 
>> --- a/drivers/of/unittest.c
>> +++ b/drivers/of/unittest.c
>> @@ -1689,19 +1689,27 @@ static const char *overlay_name_from_nr(int nr)
>>
>>  static const char *bus_path = "/testcase-data/overlay-node/test-bus";
>>
>> -/* it is guaranteed that overlay ids are assigned in sequence */
>> +/* FIXME: it is NOT guaranteed that overlay ids are assigned in sequence */
>> +
>>  #define MAX_UNITTEST_OVERLAYS  256
>>  static unsigned long overlay_id_bits[BITS_TO_LONGS(MAX_UNITTEST_OVERLAYS)];
> 
> Obviously this should have used DECLARE_BITMAP() ;-)
> 
>>  static int overlay_first_id = -1;
>>
>> +static long of_unittest_overlay_tracked(int id)
>> +{
>> +       if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
>> +               return 0;
> 
> Do we need all these checks on id? Can this really happen?
> I guess doing it once in of_unittest_track_overlay(), and aborting all
> of_unittests if it triggers should be sufficient?

Yes, that would be a better location to validate the id.  All of these
checks will go away when I get rid of the bitmap (see below).

> 
>> +       return overlay_id_bits[BIT_WORD(id)] & BIT_MASK(id);
> 
> No need for BIT_{WORD,MASK}() calculations if you would use test_bit().

I was trying to not get too carried away with cleaning up the tracking
code data structure in this patch.  In general, I would say that using
a bitmap is an over optimization given the very small number of overlays
that are tracked.  Long term I want to change it to a simpler form.

> 
>> +}
>> +
>>  static void of_unittest_track_overlay(int id)
>>  {
>>         if (overlay_first_id < 0)
>>                 overlay_first_id = id;
>>         id -= overlay_first_id;
>>
>> -       /* we shouldn't need that many */
>> -       BUG_ON(id >= MAX_UNITTEST_OVERLAYS);
>> +       if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
>> +               return;
>>         overlay_id_bits[BIT_WORD(id)] |= BIT_MASK(id);
> 
> set_bit()
> 
>>  }
>>
>> @@ -1710,7 +1718,8 @@ static void of_unittest_untrack_overlay(int id)
>>         if (overlay_first_id < 0)
>>                 return;
>>         id -= overlay_first_id;
>> -       BUG_ON(id >= MAX_UNITTEST_OVERLAYS);
>> +       if (WARN_ON(id >= MAX_UNITTEST_OVERLAYS))
>> +               return;
>>         overlay_id_bits[BIT_WORD(id)] &= ~BIT_MASK(id);
> 
> clear_bit()
> 
>>  }
>>
>> @@ -1726,7 +1735,7 @@ static void of_unittest_destroy_tracked_overlays(void)
>>                 defers = 0;
>>                 /* remove in reverse order */
> 
> If it is not guaranteed that overlay ids are assigned in sequence, the
> reverse order is not really needed, so you could replace the bitmap and
> your own tracking mechanism by DEFINE_IDR() and idr_for_each()?
> And as IDRs are flexible, MAX_UNITTEST_OVERLAYS and all checks
> could be removed, too.

The id is actually allocted in the drivers/of/overlay.c via idr.

Thanks for the thougthful review.

-Frank

> 
>>                 for (id = MAX_UNITTEST_OVERLAYS - 1; id >= 0; id--) {
>> -                       if (!(overlay_id_bits[BIT_WORD(id)] & BIT_MASK(id)))
>> +                       if (!of_unittest_overlay_tracked(id))
>>                                 continue;
>>
>>                         ovcs_id = id + overlay_first_id;
>> @@ -1743,7 +1752,7 @@ static void of_unittest_destroy_tracked_overlays(void)
>>                                 continue;
>>                         }
>>
>> -                       overlay_id_bits[BIT_WORD(id)] &= ~BIT_MASK(id);
>> +                       of_unittest_untrack_overlay(id);
>>                 }
>>         } while (defers > 0);
>>  }
> 
> Gr{oetje,eeting}s,
> 
>                         Geert
> 

Re: [PATCH 2/2] of: some unittest overlays not untracked

[Rob Herring]

On Wed, 25 Mar 2020 20:45:31 -0500, frowand.list@gmail.com wrote:
> From: Frank Rowand <frank.rowand@sony.com>
> 
> kernel test robot reported "WARNING: held lock freed!" triggered by
> unittest_gpio_remove(), which should not have been called because
> the related gpio overlay was not tracked.  Another overlay that
> was tracked had previously used the same id as the gpio overlay
> but had not been untracked when the overlay was removed.  Thus the
> clean up function of_unittest_destroy_tracked_overlays() incorrectly
> attempted to remove the reused overlay id.
> 
> Patch contents:
> 
>   - Create tracking related helper functions
>   - Change BUG() to WARN_ON() for overlay id related issues
>   - Add some additional error checking for valid overlay id values
>   - Add the missing overlay untrack
>   - update comment on expectation that overlay ids are assigned in
>     sequence
> 
> Fixes: 492a22aceb75 ("of: unittest: overlay: Keep track of created overlays")
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Frank Rowand <frank.rowand@sony.com>
> ---
>  drivers/of/unittest.c | 30 +++++++++++++++++++++++-------
>  1 file changed, 23 insertions(+), 7 deletions(-)
> 

Applied, thanks.

Rob