From: Jérôme Glisse <redacted>
The debugfs take reference on fence without dropping them. Also the
rcu section are not well balance. Fix all that ...
Signed-off-by: Jérôme Glisse <redacted>
Cc: Christian König <christian.koenig@amd.com>
Cc: Daniel Vetter <redacted>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: Stéphane Marchesin <redacted>
Cc: stable@vger.kernel.org
---
drivers/dma-buf/dma-buf.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
From: Jérôme Glisse <redacted>
The debugfs take reference on fence without dropping them. Also the
rcu section are not well balance. Fix all that ...
Signed-off-by: Jérôme Glisse <redacted>
Cc: Christian König <christian.koenig@amd.com>
Cc: Daniel Vetter <redacted>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: Stéphane Marchesin <redacted>
Cc: stable@vger.kernel.org
Well NAK, you are now taking the RCU lock twice and dropping the RCU and
still accessing fobj has a huge potential for accessing freed up memory.
The only correct thing I can see here is to grab a reference to the
fence before printing any info on it,
Christian.
On Thu, Dec 06, 2018 at 08:09:28AM +0000, Koenig, Christian wrote:
Am 06.12.18 um 02:41 schrieb jglisse@redhat.com:
quoted
From: J�r�me Glisse <redacted>
The debugfs take reference on fence without dropping them. Also the
rcu section are not well balance. Fix all that ...
Signed-off-by: J�r�me Glisse <redacted>
Cc: Christian K�nig <christian.koenig@amd.com>
Cc: Daniel Vetter <redacted>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: St�phane Marchesin <redacted>
Cc: stable@vger.kernel.org
Well NAK, you are now taking the RCU lock twice and dropping the RCU and
still accessing fobj has a huge potential for accessing freed up memory.
The only correct thing I can see here is to grab a reference to the
fence before printing any info on it,
Christian.
Hu ? That is exactly what i am doing, take reference under rcu,
rcu_unlock print the fence info, drop the fence reference, rcu
lock rinse and repeat ...
Note that the fobj in _existing_ code is access outside the rcu
end that there is an rcu imbalance in that code ie a lonlely
rcu_unlock after the for loop.
So that the existing code is broken.
On Thu, Dec 06, 2018 at 08:09:28AM +0000, Koenig, Christian wrote:
quoted
Am 06.12.18 um 02:41 schrieb jglisse@redhat.com:
quoted
From: Jérôme Glisse <redacted>
The debugfs take reference on fence without dropping them. Also the
rcu section are not well balance. Fix all that ...
Signed-off-by: Jérôme Glisse <redacted>
Cc: Christian König <christian.koenig@amd.com>
Cc: Daniel Vetter <redacted>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: Stéphane Marchesin <redacted>
Cc: stable@vger.kernel.org
Well NAK, you are now taking the RCU lock twice and dropping the RCU and
still accessing fobj has a huge potential for accessing freed up memory.
The only correct thing I can see here is to grab a reference to the
fence before printing any info on it,
Christian.
Hu ? That is exactly what i am doing, take reference under rcu,
rcu_unlock print the fence info, drop the fence reference, rcu
lock rinse and repeat ...
Note that the fobj in _existing_ code is access outside the rcu
end that there is an rcu imbalance in that code ie a lonlely
rcu_unlock after the for loop.
So that the existing code is broken.
No, the existing code is perfectly fine.
Please note the break in the loop before the rcu_unlock();
if (!read_seqcount_retry(&robj->seq, seq))
break; <- HERE!
rcu_read_unlock();
}
So your patch breaks that and take the RCU read lock twice.
Regards,
Christian.
On Thu, Dec 06, 2018 at 04:08:12PM +0000, Koenig, Christian wrote:
Am 06.12.18 um 16:21 schrieb Jerome Glisse:
quoted
On Thu, Dec 06, 2018 at 08:09:28AM +0000, Koenig, Christian wrote:
quoted
Am 06.12.18 um 02:41 schrieb jglisse@redhat.com:
quoted
From: J�r�me Glisse <redacted>
The debugfs take reference on fence without dropping them. Also the
rcu section are not well balance. Fix all that ...
Signed-off-by: J�r�me Glisse <redacted>
Cc: Christian K�nig <christian.koenig@amd.com>
Cc: Daniel Vetter <redacted>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: St�phane Marchesin <redacted>
Cc: stable@vger.kernel.org
Well NAK, you are now taking the RCU lock twice and dropping the RCU and
still accessing fobj has a huge potential for accessing freed up memory.
The only correct thing I can see here is to grab a reference to the
fence before printing any info on it,
Christian.
Hu ? That is exactly what i am doing, take reference under rcu,
rcu_unlock print the fence info, drop the fence reference, rcu
lock rinse and repeat ...
Note that the fobj in _existing_ code is access outside the rcu
end that there is an rcu imbalance in that code ie a lonlely
rcu_unlock after the for loop.
So that the existing code is broken.
No, the existing code is perfectly fine.
Please note the break in the loop before the rcu_unlock();
quoted
if (!read_seqcount_retry(&robj->seq, seq))
break; <- HERE!
rcu_read_unlock();
}
So your patch breaks that and take the RCU read lock twice.
Ok missed that, i wonder if the refcount in balance explains
the crash that was reported to me ... i sent a patch just for
that.
Thank you for reviewing and pointing out the code i was
oblivious too :)
Cheers,
J�r�me
From: kbuild test robot <hidden> Date: 2018-12-16 19:24:00
Hi J�r�me,
I love your patch! Perhaps something to improve:
[auto build test WARNING on linus/master]
[also build test WARNING on v4.20-rc6 next-20181214]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/jglisse-redhat-com/dma-buf-fix-debugfs-versus-rcu-and-fence-dumping/20181206-205935
config: x86_64-allmodconfig (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
All warnings (new ones prefixed by >>):
include/linux/slab.h:332:43: warning: dubious: x & !y
include/linux/slab.h:332:43: warning: dubious: x & !y
quoted
drivers/dma-buf/dma-buf.c:1031:9: warning: context imbalance in 'dma_buf_debug_show' - different lock contexts for basic block
vim +/dma_buf_debug_show +1031 drivers/dma-buf/dma-buf.c
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1008
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1009 #ifdef CONFIG_DEBUG_FS
eb0b947e drivers/dma-buf/dma-buf.c Mathias Krause 2016-06-19 1010 static int dma_buf_debug_show(struct seq_file *s, void *unused)
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1011 {
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1012 int ret;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1013 struct dma_buf *buf_obj;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1014 struct dma_buf_attachment *attach_obj;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1015 struct reservation_object *robj;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1016 struct reservation_object_list *fobj;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1017 struct dma_fence *fence;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1018 unsigned seq;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1019 int count = 0, attach_count, shared_count, i;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1020 size_t size = 0;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1021
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1022 ret = mutex_lock_interruptible(&db_list.lock);
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1023
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1024 if (ret)
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1025 return ret;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1026
c0b00a52 drivers/base/dma-buf.c Sumit Semwal 2014-02-03 1027 seq_puts(s, "\nDma-buf Objects:\n");
da6c8f5e drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1028 seq_printf(s, "%-8s\t%-8s\t%-8s\t%-8s\texp_name\n",
da6c8f5e drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1029 "size", "flags", "mode", "count");
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1030
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 @1031 list_for_each_entry(buf_obj, &db_list.head, list_node) {
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1032 ret = mutex_lock_interruptible(&buf_obj->lock);
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1033
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1034 if (ret) {
c0b00a52 drivers/base/dma-buf.c Sumit Semwal 2014-02-03 1035 seq_puts(s,
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1036 "\tERROR locking buffer object: skipping\n");
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1037 continue;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1038 }
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1039
c0b00a52 drivers/base/dma-buf.c Sumit Semwal 2014-02-03 1040 seq_printf(s, "%08zu\t%08x\t%08x\t%08ld\t%s\n",
c0b00a52 drivers/base/dma-buf.c Sumit Semwal 2014-02-03 1041 buf_obj->size,
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1042 buf_obj->file->f_flags, buf_obj->file->f_mode,
a1f6dbac drivers/dma-buf/dma-buf.c Al Viro 2014-08-20 1043 file_count(buf_obj->file),
c0b00a52 drivers/base/dma-buf.c Sumit Semwal 2014-02-03 1044 buf_obj->exp_name);
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1045
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1046 robj = buf_obj->resv;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1047 while (true) {
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1048 seq = read_seqcount_begin(&robj->seq);
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1049 rcu_read_lock();
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1050 fobj = rcu_dereference(robj->fence);
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1051 shared_count = fobj ? fobj->shared_count : 0;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1052 fence = rcu_dereference(robj->fence_excl);
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1053 fence = dma_fence_get_rcu(fence);
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1054 if (!read_seqcount_retry(&robj->seq, seq))
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1055 break;
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1056 rcu_read_unlock();
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1057 }
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1058 if (fence) {
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1059 seq_printf(s, "\tExclusive fence: %s %s %ssignalled\n",
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1060 fence->ops->get_driver_name(fence),
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1061 fence->ops->get_timeline_name(fence),
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1062 dma_fence_is_signaled(fence) ? "" : "un");
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1063 dma_fence_put(fence);
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1064 }
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1065
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1066 rcu_read_lock();
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1067 for (i = 0; i < shared_count; i++) {
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1068 fence = rcu_dereference(fobj->shared[i]);
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1069 if (!dma_fence_get_rcu(fence))
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1070 continue;
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1071 rcu_read_unlock();
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1072 seq_printf(s, "\tShared fence: %s %s %ssignalled\n",
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1073 fence->ops->get_driver_name(fence),
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1074 fence->ops->get_timeline_name(fence),
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1075 dma_fence_is_signaled(fence) ? "" : "un");
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1076 dma_fence_put(fence);
87e66c10 drivers/dma-buf/dma-buf.c J�r�me Glisse 2018-12-05 1077 rcu_read_lock();
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1078 }
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1079 rcu_read_unlock();
5eb2c72c drivers/dma-buf/dma-buf.c Russell King 2017-03-31 1080
c0b00a52 drivers/base/dma-buf.c Sumit Semwal 2014-02-03 1081 seq_puts(s, "\tAttached Devices:\n");
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1082 attach_count = 0;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1083
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1084 list_for_each_entry(attach_obj, &buf_obj->attachments, node) {
9eddb41d drivers/dma-buf/dma-buf.c Markus Elfring 2017-05-08 1085 seq_printf(s, "\t%s\n", dev_name(attach_obj->dev));
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1086 attach_count++;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1087 }
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1088
c0b00a52 drivers/base/dma-buf.c Sumit Semwal 2014-02-03 1089 seq_printf(s, "Total %d devices attached\n\n",
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1090 attach_count);
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1091
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1092 count++;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1093 size += buf_obj->size;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1094 mutex_unlock(&buf_obj->lock);
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1095 }
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1096
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1097 seq_printf(s, "\nTotal %d objects, %zu bytes\n", count, size);
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1098
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1099 mutex_unlock(&db_list.lock);
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1100 return 0;
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1101 }
b89e3563 drivers/base/dma-buf.c Sumit Semwal 2013-04-04 1102
:::::: The code at line 1031 was first introduced by commit
:::::: b89e35636bc75b72d15a1af6d49798802aff77d5 dma-buf: Add debugfs support
:::::: TO: Sumit Semwal [off-list ref]
:::::: CC: Sumit Semwal [off-list ref]
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation