Re: selftests: user_events: ftrace_test - RIP: 0010:tracing_update_buffers (kernel/trace/trace.c:6470)

On Fri, 27 Oct 2023 18:36:40 -0400
Steven Rostedt [off-list ref] wrote:

On Fri, 27 Oct 2023 12:20:11 -0700
Beau Belgrave [off-list ref] wrote:

quoted

On Fri, Oct 27, 2023 at 05:38:41PM +0530, Naresh Kamboju wrote:  

quoted

Following kernel crash noticed on x86_64 while running selftests: user_events:
ftrace_test running 6.6.0-rc7-next-20231026.

Reported-by: Linux Kernel Functional Testing <redacted>

kselftest: Running tests in user_events
TAP version 13
1..4
# timeout set to 90
# selftests: user_events: ftrace_test
[ 2391.606817] general protection fault, probably for non-canonical
address 0x6b6b6b6b6b6b8a83: 0000 [#1] PREEMPT SMP PTI
[ 2391.617519] CPU: 1 PID: 34662 Comm: ftrace_test Not tainted
6.6.0-rc7-next-20231026 #1
[ 2391.625428] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
2.7 12/07/2021
[ 2391.632811] RIP: 0010:tracing_update_buffers (kernel/trace/trace.c:6470)
[ 2391.637952] Code: 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00
55 31 f6 48 89 e5 41 55 41 54 53 48 89 fb 48 c7 c7 40 8c 61 94 e8 92
d3 5a 01 <44> 0f b6 a3 18 1f 00 00 41 80 fc 01 0f 87 c8 dc 4e 01 45 31  

quoted

Warning is from this code:
static void __trace_array_put(struct trace_array *this_tr)
{
        WARN_ON(!this_tr->ref);
        this_tr->ref--;
}

It seems like there might be a timing window or an incorrect call to
trace_array_put() somewhere. Do you think this is related to the eventfs
work?  

No, I think this is was probably introduced by:

  a1f157c7a3bb ("tracing: Expand all ring buffers individually")

Or possibly a mixture of the two changes? But anyway I think I need to look
at this one first.

Not sure if the bug Beau hit is the same as this one, but the one Beau
hit I think is fixed by this:

-- Steve

diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 4d2da7480e5f..4a54493b8419 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c

@@ -234,6 +234,10 @@ create_file_dentry(struct eventfs_inode *ei, struct dentry **e_dentry,
 	bool invalidate = false;
 
 	mutex_lock(&eventfs_mutex);
+	if (ei->is_freed) {
+		mutex_unlock(&eventfs_mutex);
+		return NULL;
+	}
 	/* If the e_dentry already has a dentry, use it */
 	if (*e_dentry) {
 		/* lookup does not need to up the ref count */