mm-commits.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, linux-mm@kvack.org,
	mm-commits@vger.kernel.org, paulmck@linux.vnet.ibm.com,
	thunder.leizhen@huawei.com, torvalds@linux-foundation.org
Subject: [patch 24/55] lib/list_debug.c: print more list debugging context in __list_del_entry_valid()
Date: Wed, 19 Jan 2022 18:08:59 -0800	[thread overview]
Message-ID: <20220120020859.qc9Vixzbq%akpm@linux-foundation.org> (raw)
In-Reply-To: <20220119180714.9e187ce100e4510de3cd9f7d@linux-foundation.org>

From: Zhen Lei <thunder.leizhen@huawei.com>
Subject: lib/list_debug.c: print more list debugging context in __list_del_entry_valid()

Currently, the entry->prev and entry->next are considered to be valid as
long as they are not LIST_POISON{1|2}.  However, the memory may be
corrupted.  The prev->next is invalid probably because 'prev' is invalid,
not because prev->next's content is illegal.

Unfortunately, the printk and its subfunctions will modify the registers
that hold the 'prev' and 'next', and we don't see this valuable
information in the BUG context.

So print the contents of 'entry->prev' and 'entry->next'.

Here's an example:
list_del corruption. prev->next should be c0ecbf74, but was c08410dc
kernel BUG at lib/list_debug.c:53!
... ...
PC is at __list_del_entry_valid+0x58/0x98
LR is at __list_del_entry_valid+0x58/0x98
psr: 60000093
sp : c0ecbf30  ip : 00000000  fp : 00000001
r10: c08410d0  r9 : 00000001  r8 : c0825e0c
r7 : 20000013  r6 : c08410d0  r5 : c0ecbf74  r4 : c0ecbf74
r3 : c0825d08  r2 : 00000000  r1 : df7ce6f4  r0 : 00000044
... ...
Stack: (0xc0ecbf30 to 0xc0ecc000)
bf20:                                     c0ecbf74 c0164fd0 c0ecbf70 c0165170
bf40: c0eca000 c0840c00 c0840c00 c0824500 c0825e0c c0189bbc c088f404 60000013
bf60: 60000013 c0e85100 000004ec 00000000 c0ebcdc0 c0ecbf74 c0ecbf74 c0825d08
bf80: c0e807c0 c018965c 00000000 c013f2a0 c0e807c0 c013f154 00000000 00000000
bfa0: 00000000 00000000 00000000 c01001b0 00000000 00000000 00000000 00000000
bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
(__list_del_entry_valid) from (__list_del_entry+0xc/0x20)
(__list_del_entry) from (finish_swait+0x60/0x7c)
(finish_swait) from (rcu_gp_kthread+0x560/0xa20)
(rcu_gp_kthread) from (kthread+0x14c/0x15c)
(kthread) from (ret_from_fork+0x14/0x24)

At first, I thought prev->next was overwritten.  Later, I carefully
analyzed the RCU code and the disassembly code.  The error occurred when
deleting a node from the list rcu_state.gp_wq.  The System.map shows that
the address of rcu_state is c0840c00.  Then I use gdb to obtain the offset
of rcu_state.gp_wq.task_list.

(gdb) p &((struct rcu_state *)0)->gp_wq.task_list
$1 = (struct list_head *) 0x4dc

Again:
list_del corruption. prev->next should be c0ecbf74, but was c08410dc

c08410dc = c0840c00 + 0x4dc = &rcu_state.gp_wq.task_list

Because rcu_state.gp_wq has at most one node, so I can guess that "prev =
&rcu_state.gp_wq.task_list".  But for other scenes, maybe I wasn't so
lucky, I cannot figure out the value of 'prev'.

Link: https://lkml.kernel.org/r/20211207025835.1909-1-thunder.leizhen@huawei.com
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Cc: "Paul E . McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 lib/list_debug.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/lib/list_debug.c~lib-list_debugc-print-more-list-debugging-context-in-__list_del_entry_valid
+++ a/lib/list_debug.c
@@ -49,11 +49,11 @@ bool __list_del_entry_valid(struct list_
 			"list_del corruption, %px->prev is LIST_POISON2 (%px)\n",
 			entry, LIST_POISON2) ||
 	    CHECK_DATA_CORRUPTION(prev->next != entry,
-			"list_del corruption. prev->next should be %px, but was %px\n",
-			entry, prev->next) ||
+			"list_del corruption. prev->next should be %px, but was %px. (prev=%px)\n",
+			entry, prev->next, prev) ||
 	    CHECK_DATA_CORRUPTION(next->prev != entry,
-			"list_del corruption. next->prev should be %px, but was %px\n",
-			entry, next->prev))
+			"list_del corruption. next->prev should be %px, but was %px. (next=%px)\n",
+			entry, next->prev, next))
 		return false;
 
 	return true;
_

  parent reply	other threads:[~2022-01-20  2:09 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-01-20  2:07 incoming Andrew Morton
2022-01-20  2:07 ` [patch 01/55] mm: percpu: generalize percpu related config Andrew Morton
2022-01-20  2:07 ` [patch 02/55] mm: percpu: add pcpu_fc_cpu_to_node_fn_t typedef Andrew Morton
2022-01-20  2:07 ` [patch 03/55] mm: percpu: add generic pcpu_fc_alloc/free funciton Andrew Morton
2022-01-20  2:07 ` [patch 04/55] mm: percpu: add generic pcpu_populate_pte() function Andrew Morton
2022-01-20  2:07 ` [patch 05/55] proc/vmcore: don't fake reading zeroes on surprise vmcore_cb unregistration Andrew Morton
2022-01-20  2:08 ` [patch 06/55] proc: make the proc_create[_data]() stubs static inlines Andrew Morton
2022-01-20  2:08 ` [patch 07/55] proc: convert the return type of proc_fd_access_allowed() to be boolean Andrew Morton
2022-01-20  2:08 ` [patch 08/55] sysctl: fix duplicate path separator in printed entries Andrew Morton
2022-01-20  2:08 ` [patch 09/55] sysctl: remove redundant ret assignment Andrew Morton
2022-01-20  2:08 ` [patch 10/55] include/linux/unaligned: replace kernel.h with the necessary inclusions Andrew Morton
2022-01-20  2:08 ` [patch 11/55] kernel.h: include a note to discourage people from including it in headers Andrew Morton
2022-01-20  2:08 ` [patch 12/55] fs/exec: replace strlcpy with strscpy_pad in __set_task_comm Andrew Morton
2022-01-20  2:08 ` [patch 13/55] fs/exec: replace strncpy with strscpy_pad in __get_task_comm Andrew Morton
2022-01-20  2:08 ` [patch 14/55] drivers/infiniband: replace open-coded string copy with get_task_comm Andrew Morton
2022-01-20  2:08 ` [patch 15/55] fs/binfmt_elf: " Andrew Morton
2022-01-20  2:08 ` [patch 16/55] samples/bpf/test_overhead_kprobe_kern: replace bpf_probe_read_kernel with bpf_probe_read_kernel_str to get task comm Andrew Morton
2022-01-20  2:08 ` [patch 17/55] tools/bpf/bpftool/skeleton: " Andrew Morton
2022-01-20  2:08 ` [patch 18/55] tools/testing/selftests/bpf: replace open-coded 16 with TASK_COMM_LEN Andrew Morton
2022-01-20  2:08 ` [patch 19/55] kthread: dynamically allocate memory to store kthread's full name Andrew Morton
2022-01-20  2:08 ` [patch 20/55] kernel/sys.c: only take tasklist_lock for get/setpriority(PRIO_PGRP) Andrew Morton
2022-01-20  2:08 ` [patch 21/55] get_maintainer: don't remind about no git repo when --nogit is used Andrew Morton
2022-01-20  2:08 ` [patch 22/55] kstrtox: uninline everything Andrew Morton
2022-01-20  2:08 ` [patch 23/55] list: introduce list_is_head() helper and re-use it in list.h Andrew Morton
2022-01-20  2:08 ` Andrew Morton [this message]
2022-01-20  2:09 ` [patch 25/55] hash.h: remove unused define directive Andrew Morton
2022-01-20  2:09 ` [patch 26/55] test_hash.c: split test_int_hash into arch-specific functions Andrew Morton
2022-01-20  2:09 ` [patch 27/55] test_hash.c: split test_hash_init Andrew Morton
2022-01-20  2:09 ` [patch 28/55] lib/Kconfig.debug: properly split hash test kernel entries Andrew Morton
2022-01-20  2:09 ` [patch 29/55] test_hash.c: refactor into kunit Andrew Morton
2022-01-20  2:09 ` [patch 30/55] kunit: replace kernel.h with the necessary inclusions Andrew Morton
2022-01-20  2:09 ` [patch 31/55] uuid: discourage people from using UAPI header in new code Andrew Morton
2022-01-20  2:09 ` [patch 32/55] uuid: remove licence boilerplate text from the header Andrew Morton
2022-01-20  2:09 ` [patch 33/55] lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test Andrew Morton
2022-01-20  2:09 ` [patch 34/55] checkpatch: relax regexp for COMMIT_LOG_LONG_LINE Andrew Morton
2022-01-20  2:09 ` [patch 35/55] checkpatch: improve Kconfig help test Andrew Morton
2022-01-20  2:09 ` [patch 36/55] const_structs.checkpatch: add frequently used ops structs Andrew Morton
2022-01-20  2:09 ` [patch 37/55] fs/binfmt_elf: use PT_LOAD p_align values for static PIE Andrew Morton
2022-01-20  2:09 ` [patch 38/55] nilfs2: remove redundant pointer sbufs Andrew Morton
2022-01-20  2:09 ` [patch 39/55] hfsplus: use struct_group_attr() for memcpy() region Andrew Morton
2022-01-20  2:09 ` [patch 40/55] FAT: use io_schedule_timeout() instead of congestion_wait() Andrew Morton
2022-01-20  2:09 ` [patch 41/55] fs/adfs: remove unneeded variable make code cleaner Andrew Morton
2022-01-20  2:09 ` [patch 42/55] panic: use error_report_end tracepoint on warnings Andrew Morton
2022-01-20  2:09 ` [patch 43/55] panic: remove oops_id Andrew Morton
2022-01-20  2:10 ` [patch 44/55] delayacct: support swapin delay accounting for swapping without blkio Andrew Morton
2022-01-20  2:10 ` [patch 45/55] delayacct: fix incomplete disable operation when switch enable to disable Andrew Morton
2022-01-20  2:10 ` [patch 46/55] delayacct: cleanup flags in struct task_delay_info and functions use it Andrew Morton
2022-01-20  2:10 ` [patch 47/55] Documentation/accounting/delay-accounting.rst: add thrashing page cache and direct compact Andrew Morton
2022-01-20  2:10 ` [patch 48/55] delayacct: track delays from memory compact Andrew Morton
2022-01-20  2:10 ` [patch 49/55] configs: introduce debug.config for CI-like setup Andrew Morton
2022-01-20  2:10 ` [patch 50/55] arch/Kconfig: split PAGE_SIZE_LESS_THAN_256KB from PAGE_SIZE_LESS_THAN_64KB Andrew Morton
2022-01-20  2:10 ` [patch 51/55] btrfs: use generic Kconfig option for 256kB page size limit Andrew Morton
2022-01-20  2:10 ` [patch 52/55] lib/Kconfig.debug: make TEST_KMOD depend on PAGE_SIZE_LESS_THAN_256KB Andrew Morton
2022-01-20  2:10 ` [patch 53/55] kcov: fix generic Kconfig dependencies if ARCH_WANTS_NO_INSTR Andrew Morton
2022-01-20  2:10 ` [patch 54/55] ubsan: remove CONFIG_UBSAN_OBJECT_SIZE Andrew Morton
2022-01-20  2:10 ` [patch 55/55] lib: remove redundant assignment to variable ret Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220120020859.qc9Vixzbq%akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mm-commits@vger.kernel.org \
    --cc=paulmck@linux.vnet.ibm.com \
    --cc=thunder.leizhen@huawei.com \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).