From: Andrzej Hajda <andrzej.hajda@intel.com>
To: linux-kernel@vger.kernel.org, intel-gfx@lists.freedesktop.org,
dri-devel@lists.freedesktop.org, netdev <netdev@vger.kernel.org>
Cc: Eric Dumazet <edumazet@google.com>,
Jani Nikula <jani.nikula@linux.intel.com>,
Daniel Vetter <daniel@ffwll.ch>,
Lucas De Marchi <lucas.demarchi@intel.com>,
Andrzej Hajda <andrzej.hajda@intel.com>,
Chris Wilson <chris.p.wilson@intel.com>,
Dmitry Vyukov <dvyukov@google.com>,
Jakub Kicinski <kuba@kernel.org>,
"David S . Miller" <davem@davemloft.net>
Subject: [PATCH v2 01/11] ref_tracker: implement use-after-free detection
Date: Tue, 22 Feb 2022 00:16:45 +0100 [thread overview]
Message-ID: <20220221231705.1481059-4-andrzej.hajda@intel.com> (raw)
In-Reply-To: <20220221231705.1481059-1-andrzej.hajda@intel.com>
From: Eric Dumazet <edumazet@google.com>
Whenever ref_tracker_dir_init() is called, mark the struct ref_tracker_dir
as dead.
Test the dead status from ref_tracker_alloc() and ref_tracker_free()
This should detect buggy dev_put()/dev_hold() happening too late
in netdevice dismantle process.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com>
---
include/linux/ref_tracker.h | 2 ++
lib/ref_tracker.c | 5 +++++
2 files changed, 7 insertions(+)
diff --git a/include/linux/ref_tracker.h b/include/linux/ref_tracker.h
index 60f3453be23e6..a443abda937d8 100644
--- a/include/linux/ref_tracker.h
+++ b/include/linux/ref_tracker.h
@@ -13,6 +13,7 @@ struct ref_tracker_dir {
spinlock_t lock;
unsigned int quarantine_avail;
refcount_t untracked;
+ bool dead;
struct list_head list; /* List of active trackers */
struct list_head quarantine; /* List of dead trackers */
#endif
@@ -26,6 +27,7 @@ static inline void ref_tracker_dir_init(struct ref_tracker_dir *dir,
INIT_LIST_HEAD(&dir->quarantine);
spin_lock_init(&dir->lock);
dir->quarantine_avail = quarantine_count;
+ dir->dead = false;
refcount_set(&dir->untracked, 1);
stack_depot_init();
}
diff --git a/lib/ref_tracker.c b/lib/ref_tracker.c
index a6789c0c626b0..32ff6bd497f8e 100644
--- a/lib/ref_tracker.c
+++ b/lib/ref_tracker.c
@@ -20,6 +20,7 @@ void ref_tracker_dir_exit(struct ref_tracker_dir *dir)
unsigned long flags;
bool leak = false;
+ dir->dead = true;
spin_lock_irqsave(&dir->lock, flags);
list_for_each_entry_safe(tracker, n, &dir->quarantine, head) {
list_del(&tracker->head);
@@ -72,6 +73,8 @@ int ref_tracker_alloc(struct ref_tracker_dir *dir,
gfp_t gfp_mask = gfp;
unsigned long flags;
+ WARN_ON_ONCE(dir->dead);
+
if (gfp & __GFP_DIRECT_RECLAIM)
gfp_mask |= __GFP_NOFAIL;
*trackerp = tracker = kzalloc(sizeof(*tracker), gfp_mask);
@@ -100,6 +103,8 @@ int ref_tracker_free(struct ref_tracker_dir *dir,
unsigned int nr_entries;
unsigned long flags;
+ WARN_ON_ONCE(dir->dead);
+
if (!tracker) {
refcount_dec(&dir->untracked);
return -EEXIST;
--
2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: Andrzej Hajda <andrzej.hajda@intel.com>
To: linux-kernel@vger.kernel.org, intel-gfx@lists.freedesktop.org,
dri-devel@lists.freedesktop.org, netdev <netdev@vger.kernel.org>
Cc: Andrzej Hajda <andrzej.hajda@intel.com>,
Lucas De Marchi <lucas.demarchi@intel.com>,
Chris Wilson <chris.p.wilson@intel.com>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
"David S . Miller" <davem@davemloft.net>,
Dmitry Vyukov <dvyukov@google.com>
Subject: [PATCH v2 01/11] ref_tracker: implement use-after-free detection
Date: Tue, 22 Feb 2022 00:16:45 +0100 [thread overview]
Message-ID: <20220221231705.1481059-4-andrzej.hajda@intel.com> (raw)
In-Reply-To: <20220221231705.1481059-1-andrzej.hajda@intel.com>
From: Eric Dumazet <edumazet@google.com>
Whenever ref_tracker_dir_init() is called, mark the struct ref_tracker_dir
as dead.
Test the dead status from ref_tracker_alloc() and ref_tracker_free()
This should detect buggy dev_put()/dev_hold() happening too late
in netdevice dismantle process.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com>
---
include/linux/ref_tracker.h | 2 ++
lib/ref_tracker.c | 5 +++++
2 files changed, 7 insertions(+)
diff --git a/include/linux/ref_tracker.h b/include/linux/ref_tracker.h
index 60f3453be23e6..a443abda937d8 100644
--- a/include/linux/ref_tracker.h
+++ b/include/linux/ref_tracker.h
@@ -13,6 +13,7 @@ struct ref_tracker_dir {
spinlock_t lock;
unsigned int quarantine_avail;
refcount_t untracked;
+ bool dead;
struct list_head list; /* List of active trackers */
struct list_head quarantine; /* List of dead trackers */
#endif
@@ -26,6 +27,7 @@ static inline void ref_tracker_dir_init(struct ref_tracker_dir *dir,
INIT_LIST_HEAD(&dir->quarantine);
spin_lock_init(&dir->lock);
dir->quarantine_avail = quarantine_count;
+ dir->dead = false;
refcount_set(&dir->untracked, 1);
stack_depot_init();
}
diff --git a/lib/ref_tracker.c b/lib/ref_tracker.c
index a6789c0c626b0..32ff6bd497f8e 100644
--- a/lib/ref_tracker.c
+++ b/lib/ref_tracker.c
@@ -20,6 +20,7 @@ void ref_tracker_dir_exit(struct ref_tracker_dir *dir)
unsigned long flags;
bool leak = false;
+ dir->dead = true;
spin_lock_irqsave(&dir->lock, flags);
list_for_each_entry_safe(tracker, n, &dir->quarantine, head) {
list_del(&tracker->head);
@@ -72,6 +73,8 @@ int ref_tracker_alloc(struct ref_tracker_dir *dir,
gfp_t gfp_mask = gfp;
unsigned long flags;
+ WARN_ON_ONCE(dir->dead);
+
if (gfp & __GFP_DIRECT_RECLAIM)
gfp_mask |= __GFP_NOFAIL;
*trackerp = tracker = kzalloc(sizeof(*tracker), gfp_mask);
@@ -100,6 +103,8 @@ int ref_tracker_free(struct ref_tracker_dir *dir,
unsigned int nr_entries;
unsigned long flags;
+ WARN_ON_ONCE(dir->dead);
+
if (!tracker) {
refcount_dec(&dir->untracked);
return -EEXIST;
--
2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: Andrzej Hajda <andrzej.hajda@intel.com>
To: linux-kernel@vger.kernel.org, intel-gfx@lists.freedesktop.org,
dri-devel@lists.freedesktop.org, netdev <netdev@vger.kernel.org>
Cc: Andrzej Hajda <andrzej.hajda@intel.com>,
Lucas De Marchi <lucas.demarchi@intel.com>,
Chris Wilson <chris.p.wilson@intel.com>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
"David S . Miller" <davem@davemloft.net>,
Dmitry Vyukov <dvyukov@google.com>
Subject: [Intel-gfx] [PATCH v2 01/11] ref_tracker: implement use-after-free detection
Date: Tue, 22 Feb 2022 00:16:45 +0100 [thread overview]
Message-ID: <20220221231705.1481059-4-andrzej.hajda@intel.com> (raw)
In-Reply-To: <20220221231705.1481059-1-andrzej.hajda@intel.com>
From: Eric Dumazet <edumazet@google.com>
Whenever ref_tracker_dir_init() is called, mark the struct ref_tracker_dir
as dead.
Test the dead status from ref_tracker_alloc() and ref_tracker_free()
This should detect buggy dev_put()/dev_hold() happening too late
in netdevice dismantle process.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com>
---
include/linux/ref_tracker.h | 2 ++
lib/ref_tracker.c | 5 +++++
2 files changed, 7 insertions(+)
diff --git a/include/linux/ref_tracker.h b/include/linux/ref_tracker.h
index 60f3453be23e6..a443abda937d8 100644
--- a/include/linux/ref_tracker.h
+++ b/include/linux/ref_tracker.h
@@ -13,6 +13,7 @@ struct ref_tracker_dir {
spinlock_t lock;
unsigned int quarantine_avail;
refcount_t untracked;
+ bool dead;
struct list_head list; /* List of active trackers */
struct list_head quarantine; /* List of dead trackers */
#endif
@@ -26,6 +27,7 @@ static inline void ref_tracker_dir_init(struct ref_tracker_dir *dir,
INIT_LIST_HEAD(&dir->quarantine);
spin_lock_init(&dir->lock);
dir->quarantine_avail = quarantine_count;
+ dir->dead = false;
refcount_set(&dir->untracked, 1);
stack_depot_init();
}
diff --git a/lib/ref_tracker.c b/lib/ref_tracker.c
index a6789c0c626b0..32ff6bd497f8e 100644
--- a/lib/ref_tracker.c
+++ b/lib/ref_tracker.c
@@ -20,6 +20,7 @@ void ref_tracker_dir_exit(struct ref_tracker_dir *dir)
unsigned long flags;
bool leak = false;
+ dir->dead = true;
spin_lock_irqsave(&dir->lock, flags);
list_for_each_entry_safe(tracker, n, &dir->quarantine, head) {
list_del(&tracker->head);
@@ -72,6 +73,8 @@ int ref_tracker_alloc(struct ref_tracker_dir *dir,
gfp_t gfp_mask = gfp;
unsigned long flags;
+ WARN_ON_ONCE(dir->dead);
+
if (gfp & __GFP_DIRECT_RECLAIM)
gfp_mask |= __GFP_NOFAIL;
*trackerp = tracker = kzalloc(sizeof(*tracker), gfp_mask);
@@ -100,6 +103,8 @@ int ref_tracker_free(struct ref_tracker_dir *dir,
unsigned int nr_entries;
unsigned long flags;
+ WARN_ON_ONCE(dir->dead);
+
if (!tracker) {
refcount_dec(&dir->untracked);
return -EEXIST;
--
2.25.1
next prev parent reply other threads:[~2022-02-21 23:17 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-21 23:16 [PATCH v2 00/11] drm/i915: use ref_tracker library for tracking wakerefs Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 01/11] [DO NOT MERGE] ref_tracker: implement use-after-free detection Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 1/9] lib/ref_tracker: add unlocked leak print helper Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda [this message]
2022-02-21 23:16 ` [Intel-gfx] [PATCH v2 01/11] ref_tracker: implement use-after-free detection Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 02/11] [DO NOT MERGE] ref_tracker: add a count of untracked references Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 2/9] lib/ref_tracker: compact stacktraces before printing Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 02/11] ref_tracker: add a count of untracked references Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 03/11] [DO NOT MERGE] ref_tracker: remove filter_irq_stacks() call Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 3/9] lib/ref_tracker: __ref_tracker_dir_print improve printing Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 03/11] ref_tracker: remove filter_irq_stacks() call Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 4/9] lib/ref_tracker: add printing to memory buffer Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 04/11] lib/ref_tracker: add unlocked leak print helper Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 5/9] lib/ref_tracker: improve allocation flags Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 05/11] lib/ref_tracker: __ref_tracker_dir_print improve printing Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 6/9] drm/i915: Separate wakeref tracking Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 06/11] lib/ref_tracker: add printing to memory buffer Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 7/9] drm/i915: Track leaked gt->wakerefs Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [PATCH v2 07/11] lib/ref_tracker: remove warnings in case of allocation failure Andrzej Hajda
2022-02-21 23:16 ` Andrzej Hajda
2022-02-21 23:16 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:17 ` [PATCH v2 8/9] drm/i915: Correct type of wakeref variable Andrzej Hajda
2022-02-21 23:17 ` Andrzej Hajda
2022-02-21 23:17 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:17 ` [PATCH v2 08/11] drm/i915: Separate wakeref tracking Andrzej Hajda
2022-02-21 23:17 ` Andrzej Hajda
2022-02-21 23:17 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:17 ` [PATCH v2 9/9] drm/i915: replace Intel internal tracker with kernel core ref_tracker Andrzej Hajda
2022-02-21 23:17 ` Andrzej Hajda
2022-02-21 23:17 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:17 ` [PATCH v2 09/11] drm/i915: Track leaked gt->wakerefs Andrzej Hajda
2022-02-21 23:17 ` Andrzej Hajda
2022-02-21 23:17 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:17 ` [PATCH v2 10/11] drm/i915: Correct type of wakeref variable Andrzej Hajda
2022-02-21 23:17 ` Andrzej Hajda
2022-02-21 23:17 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:17 ` [Intel-gfx] [PATCH v2 11/11] drm/i915: replace Intel internal tracker with kernel core ref_tracker Andrzej Hajda
2022-02-21 23:17 ` Andrzej Hajda
2022-02-21 23:17 ` Andrzej Hajda
2022-02-21 23:23 ` [PATCH v2 00/11] drm/i915: use ref_tracker library for tracking wakerefs Andrzej Hajda
2022-02-21 23:23 ` [Intel-gfx] " Andrzej Hajda
2022-02-21 23:23 ` Andrzej Hajda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220221231705.1481059-4-andrzej.hajda@intel.com \
--to=andrzej.hajda@intel.com \
--cc=chris.p.wilson@intel.com \
--cc=daniel@ffwll.ch \
--cc=davem@davemloft.net \
--cc=dri-devel@lists.freedesktop.org \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jani.nikula@linux.intel.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lucas.demarchi@intel.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.