Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

11aa: streamline retransmission function #20

Open
twpedersen opened this issue Dec 5, 2012 · 1 comment
Open

11aa: streamline retransmission function #20

twpedersen opened this issue Dec 5, 2012 · 1 comment

Comments

@twpedersen
Copy link
Contributor

ieee80211aa_retransmit() will pass a sequnce number to ieee80211aa_retransmit_frame(), which will then iterate the skb queue looking for that sn.

Instead, ieee80211aa_retransmit() should pass a scoreboard of unacked frames and ieee80211aa_retransmit_frame() will only have to walk the skb queue once.
@twpedersen
Copy link
Contributor Author

This can work if

  1. skbs are sorted by seqnum
  2. we have a per-sender mcast rexmit queue.

twpedersen pushed a commit that referenced this issue May 22, 2013
@aakoskin
ARM: 7692/1: iop3xx: move IOP3XX_PERIPHERAL_VIRT_BASE
f5d6a14 
Currently IOP3XX_PERIPHERAL_VIRT_BASE conflicts with PCI_IO_VIRT_BASE:

					address         size
	PCI_IO_VIRT_BASE                0xfee00000      0x200000
	IOP3XX_PERIPHERAL_VIRT_BASE     0xfeffe000      0x2000

Fix by moving IOP3XX_PERIPHERAL_VIRT_BASE below PCI_IO_VIRT_BASE.

The patch fixes the following kernel panic with 3.9-rc1 on iop3xx boards:

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.9.0-rc1-iop32x (aaro@blackmetal) (gcc version 4.7.2 (GCC) ) #20 PREEMPT Tue Mar 5 16:44:36 EET 2013
[    0.000000] bootconsole [earlycon0] enabled
[    0.000000] ------------[ cut here ]------------
[    0.000000] kernel BUG at mm/vmalloc.c:1145!
[    0.000000] Internal error: Oops - BUG: 0 [#1] PREEMPT ARM
[    0.000000] Modules linked in:
[    0.000000] CPU: 0    Not tainted  (3.9.0-rc1-iop32x #20)
[    0.000000] PC is at vm_area_add_early+0x4c/0x88
[    0.000000] LR is at add_static_vm_early+0x14/0x68
[    0.000000] pc : [<c03e74a8>]    lr : [<c03e1c40>]    psr: 800000d3
[    0.000000] sp : c03ffee4  ip : dfffdf88  fp : c03ffef4
[    0.000000] r10: 00000002  r9 : 000000cf  r8 : 00000653
[    0.000000] r7 : c040eca8  r6 : c03e2408  r5 : dfffdf60  r4 : 00200000
[    0.000000] r3 : dfffdfd8  r2 : feffe000  r1 : ff000000  r0 : dfffdf60
[    0.000000] Flags: Nzcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
[    0.000000] Control: 0000397f  Table: a0004000  DAC: 00000017
[    0.000000] Process swapper (pid: 0, stack limit = 0xc03fe1b8)
[    0.000000] Stack: (0xc03ffee4 to 0xc0400000)
[    0.000000] fee0:          00200000 c03fff0c c03ffef8 c03e1c40 c03e7468 00200000 fee00000
[    0.000000] ff00: c03fff2c c03fff10 c03e23e4 c03e1c38 feffe000 c0408ee4 ff000000 c0408f04
[    0.000000] ff20: c03fff3c c03fff30 c03e2434 c03e23b4 c03fff84 c03fff40 c03e2c94 c03e2414
[    0.000000] ff40: c03f8878 c03f6410 ffff0000 000bffff 00001000 00000008 c03fff84 c03f6410
[    0.000000] ff60: c04227e8 c03fffd4 a0008000 c03f8878 69052e30 c02f96eb c03fffbc c03fff88
[    0.000000] ff80: c03e044c c03e268c 00000000 0000397f c0385130 00000001 ffffffff c03f8874
[    0.000000] ffa0: dfffffff a0004000 69052e30 a03f61a0 c03ffff4 c03fffc0 c03dd5cc c03e0184
[    0.000000] ffc0: 00000000 00000000 00000000 00000000 00000000 c03f8878 0000397d c040601c
[    0.000000] ffe0: c03f8874 c0408674 00000000 c03ffff8 a0008040 c03dd558 00000000 00000000
[    0.000000] Backtrace:
[    0.000000] [<c03e745c>] (vm_area_add_early+0x0/0x88) from [<c03e1c40>] (add_static_vm_early+0x14/0x68)

Tested-by: Mikael Pettersson <[email protected]>
Signed-off-by: Aaro Koskinen <[email protected]>
Signed-off-by: Russell King <[email protected]>
jasonabele pushed a commit that referenced this issue Aug 16, 2013
@gregkh
nfsd: nfsd_open: when dentry_open returns an error do not propagate a…
ce4eb5e 
…s struct file

commit e4daf1f upstream.

The following call chain:
------------------------------------------------------------
nfs4_get_vfs_file
- nfsd_open
  - dentry_open
    - do_dentry_open
      - __get_file_write_access
        - get_write_access
          - return atomic_inc_unless_negative(&inode->i_writecount) ? 0 : -ETXTBSY;
------------------------------------------------------------

can result in the following state:
------------------------------------------------------------
struct nfs4_file {
...
  fi_fds = {0xffff880c1fa65c80, 0xffffffffffffffe6, 0x0},
  fi_access = {{
      counter = 0x1
    }, {
      counter = 0x0
    }},
...
------------------------------------------------------------

1) First time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NULL, hence nfsd_open() is called where we get status set to an error
and fp->fi_fds[O_WRONLY] to -ETXTBSY. Thus we do not reach
nfs4_file_get_access() and fi_access[O_WRONLY] is not incremented.

2) Second time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NOT NULL (-ETXTBSY), so nfsd_open() is NOT called, but
nfs4_file_get_access() IS called and fi_access[O_WRONLY] is incremented.
Thus we leave a landmine in the form of the nfs4_file data structure in
an incorrect state.

3) Eventually, when __nfs4_file_put_access() is called it finds
fi_access[O_WRONLY] being non-zero, it decrements it and calls
nfs4_file_put_fd() which tries to fput -ETXTBSY.
------------------------------------------------------------
...
     [exception RIP: fput+0x9]
     RIP: ffffffff81177fa9  RSP: ffff88062e365c90  RFLAGS: 00010282
     RAX: ffff880c2b3d99cc  RBX: ffff880c2b3d9978  RCX: 0000000000000002
     RDX: dead000000100101  RSI: 0000000000000001  RDI: ffffffffffffffe6
     RBP: ffff88062e365c90   R8: ffff88041fe797d8   R9: ffff88062e365d58
     R10: 0000000000000008  R11: 0000000000000000  R12: 0000000000000001
     R13: 0000000000000007  R14: 0000000000000000  R15: 0000000000000000
     ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
  #9 [ffff88062e365c98] __nfs4_file_put_access at ffffffffa0562334 [nfsd]
 #10 [ffff88062e365cc8] nfs4_file_put_access at ffffffffa05623ab [nfsd]
 #11 [ffff88062e365ce8] free_generic_stateid at ffffffffa056634d [nfsd]
 #12 [ffff88062e365d18] release_open_stateid at ffffffffa0566e4b [nfsd]
 #13 [ffff88062e365d38] nfsd4_close at ffffffffa0567401 [nfsd]
 #14 [ffff88062e365d88] nfsd4_proc_compound at ffffffffa0557f28 [nfsd]
 #15 [ffff88062e365dd8] nfsd_dispatch at ffffffffa054543e [nfsd]
 #16 [ffff88062e365e18] svc_process_common at ffffffffa04ba5a4 [sunrpc]
 #17 [ffff88062e365e98] svc_process at ffffffffa04babe0 [sunrpc]
 #18 [ffff88062e365eb8] nfsd at ffffffffa0545b62 [nfsd]
 #19 [ffff88062e365ee8] kthread at ffffffff81090886
 #20 [ffff88062e365f48] kernel_thread at ffffffff8100c14a
------------------------------------------------------------

Signed-off-by: Harshula Jayasuriya <[email protected]>
Signed-off-by: J. Bruce Fields <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
chunyeow pushed a commit that referenced this issue Aug 29, 2013
@mlankhorst @airlied
drm/cirrus: do not attempt to acquire a reservation while in an inter…
19d4b72 
…rupt handler

Mutexes should not be acquired in interrupt context. While the trylock
fastpath is arguably safe on all implementations, the slowpath
unlock path definitely isn't. This fixes the following lockdep splat:

[   13.044313] ------------[ cut here ]------------
[   13.044367] WARNING: at /c/kernel-tests/src/tip/kernel/mutex.c:858 mutex_trylock+0x87/0x220()
[   13.044378] DEBUG_LOCKS_WARN_ON(in_interrupt())
[   13.044378] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.10.0-rc4-00296-ga2963dd #20
[   13.044379] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[   13.044390]  0000000000000009 ffff88000de039f8 ffffffff81fc86d5 ffff88000de03a38
[   13.044395]  ffffffff810d511b ffff880000000018 ffff88000f33c690 0000000000000001
[   13.044398]  00000000000003f0 ffff88000f4677c8 0000000000000000 ffff88000de03a98
[   13.044400] Call Trace:
[   13.044412]  <IRQ>  [<ffffffff81fc86d5>] dump_stack+0x19/0x1b
[   13.044441]  [<ffffffff810d511b>] warn_slowpath_common+0x6b/0x90
[   13.044445]  [<ffffffff810d51a6>] warn_slowpath_fmt+0x46/0x50
[   13.044448]  [<ffffffff81fd34d7>] mutex_trylock+0x87/0x220
[   13.044482]  [<ffffffff8186484d>] cirrus_dirty_update+0x1cd/0x330
[   13.044486]  [<ffffffff818649e8>] cirrus_imageblit+0x38/0x50
[   13.044506]  [<ffffffff8165782e>] soft_cursor+0x22e/0x240
[   13.044510]  [<ffffffff81656c31>] bit_cursor+0x581/0x5b0
[   13.044525]  [<ffffffff815de9f4>] ? vsnprintf+0x124/0x670
[   13.044529]  [<ffffffff81651333>] ? get_color.isra.16+0x43/0x130
[   13.044532]  [<ffffffff81653fca>] fbcon_cursor+0x18a/0x1d0
[   13.044535]  [<ffffffff816566b0>] ? update_attr.isra.2+0xa0/0xa0
[   13.044556]  [<ffffffff81754b82>] hide_cursor+0x32/0xa0
[   13.044565]  [<ffffffff81755bd3>] vt_console_print+0x103/0x3b0
[   13.044569]  [<ffffffff810d58ac>] ? print_time+0x9c/0xb0
[   13.044576]  [<ffffffff810d5960>] ? print_prefix+0xa0/0xc0
[   13.044580]  [<ffffffff810d63f6>] call_console_drivers.constprop.6+0x146/0x1f0
[   13.044593]  [<ffffffff815f9b38>] ? do_raw_spin_unlock+0xc8/0x100
[   13.044597]  [<ffffffff810d6f27>] console_unlock+0x2f7/0x460
[   13.044600]  [<ffffffff810d787a>] vprintk_emit+0x59a/0x5e0
[   13.044615]  [<ffffffff81fb676c>] printk+0x4d/0x4f
[   13.044650]  [<ffffffff82ba5511>] print_local_APIC+0x28/0x41c
[   13.044672]  [<ffffffff8114db55>] generic_smp_call_function_single_interrupt+0x145/0x2b0
[   13.044688]  [<ffffffff8106f9e7>] smp_call_function_single_interrupt+0x27/0x40
[   13.044697]  [<ffffffff81fd8f72>] call_function_single_interrupt+0x72/0x80
[   13.044707]  <EOI>  [<ffffffff81078166>] ? native_safe_halt+0x6/0x10
[   13.044717]  [<ffffffff811425cd>] ? trace_hardirqs_on+0xd/0x10
[   13.044738]  [<ffffffff8104f669>] default_idle+0x59/0x120
[   13.044742]  [<ffffffff810501e8>] arch_cpu_idle+0x18/0x40
[   13.044754]  [<ffffffff811320c5>] cpu_startup_entry+0x235/0x410
[   13.044763]  [<ffffffff81f9e781>] rest_init+0xd1/0xe0
[   13.044766]  [<ffffffff81f9e6b5>] ? rest_init+0x5/0xe0
[   13.044778]  [<ffffffff82b93ec2>] start_kernel+0x425/0x493
[   13.044781]  [<ffffffff82b93810>] ? repair_env_string+0x5e/0x5e
[   13.044786]  [<ffffffff82b93595>] x86_64_start_reservations+0x2a/0x2c
[   13.044789]  [<ffffffff82b93688>] x86_64_start_kernel+0xf1/0x100
[   13.044799] ---[ end trace 113ad28772af4058 ]---

Reported-by: Fengguang Wu <[email protected]>
Signed-off-by: Maarten Lankhorst <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
chunyeow pushed a commit that referenced this issue Aug 29, 2013
@davem330
bridge: fix some kernel warning in multicast timer
c7e8e8a 
Several people reported the warning: "kernel BUG at kernel/timer.c:729!"
and the stack trace is:

	#7 [ffff880214d25c10] mod_timer+501 at ffffffff8106d905
	#8 [ffff880214d25c50] br_multicast_del_pg.isra.20+261 at ffffffffa0731d25 [bridge]
	#9 [ffff880214d25c80] br_multicast_disable_port+88 at ffffffffa0732948 [bridge]
	#10 [ffff880214d25cb0] br_stp_disable_port+154 at ffffffffa072bcca [bridge]
	#11 [ffff880214d25ce8] br_device_event+520 at ffffffffa072a4e8 [bridge]
	#12 [ffff880214d25d18] notifier_call_chain+76 at ffffffff8164aafc
	#13 [ffff880214d25d50] raw_notifier_call_chain+22 at ffffffff810858f6
	#14 [ffff880214d25d60] call_netdevice_notifiers+45 at ffffffff81536aad
	#15 [ffff880214d25d80] dev_close_many+183 at ffffffff81536d17
	#16 [ffff880214d25dc0] rollback_registered_many+168 at ffffffff81537f68
	#17 [ffff880214d25de8] rollback_registered+49 at ffffffff81538101
	#18 [ffff880214d25e10] unregister_netdevice_queue+72 at ffffffff815390d8
	#19 [ffff880214d25e30] __tun_detach+272 at ffffffffa074c2f0 [tun]
	#20 [ffff880214d25e88] tun_chr_close+45 at ffffffffa074c4bd [tun]
	#21 [ffff880214d25ea8] __fput+225 at ffffffff8119b1f1
	#22 [ffff880214d25ef0] ____fput+14 at ffffffff8119b3fe
	#23 [ffff880214d25f00] task_work_run+159 at ffffffff8107cf7f
	#24 [ffff880214d25f30] do_notify_resume+97 at ffffffff810139e1
	#25 [ffff880214d25f50] int_signal+18 at ffffffff8164f292

this is due to I forgot to check if mp->timer is armed in
br_multicast_del_pg(). This bug is introduced by
commit 9f00b2e (bridge: only expire the mdb entry
when query is received).

Same for __br_mdb_del().

Tested-by: poma <[email protected]>
Reported-by: LiYonghua <[email protected]>
Reported-by: Robert Hancock <[email protected]>
Cc: Herbert Xu <[email protected]>
Cc: Stephen Hemminger <[email protected]>
Cc: "David S. Miller" <[email protected]>
Signed-off-by: Cong Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
ctwitty pushed a commit that referenced this issue Sep 5, 2013
nfsd: nfsd_open: when dentry_open returns an error do not propagate a…
e4daf1f 
…s struct file

The following call chain:
------------------------------------------------------------
nfs4_get_vfs_file
- nfsd_open
  - dentry_open
    - do_dentry_open
      - __get_file_write_access
        - get_write_access
          - return atomic_inc_unless_negative(&inode->i_writecount) ? 0 : -ETXTBSY;
------------------------------------------------------------

can result in the following state:
------------------------------------------------------------
struct nfs4_file {
...
  fi_fds = {0xffff880c1fa65c80, 0xffffffffffffffe6, 0x0},
  fi_access = {{
      counter = 0x1
    }, {
      counter = 0x0
    }},
...
------------------------------------------------------------

1) First time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NULL, hence nfsd_open() is called where we get status set to an error
and fp->fi_fds[O_WRONLY] to -ETXTBSY. Thus we do not reach
nfs4_file_get_access() and fi_access[O_WRONLY] is not incremented.

2) Second time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NOT NULL (-ETXTBSY), so nfsd_open() is NOT called, but
nfs4_file_get_access() IS called and fi_access[O_WRONLY] is incremented.
Thus we leave a landmine in the form of the nfs4_file data structure in
an incorrect state.

3) Eventually, when __nfs4_file_put_access() is called it finds
fi_access[O_WRONLY] being non-zero, it decrements it and calls
nfs4_file_put_fd() which tries to fput -ETXTBSY.
------------------------------------------------------------
...
     [exception RIP: fput+0x9]
     RIP: ffffffff81177fa9  RSP: ffff88062e365c90  RFLAGS: 00010282
     RAX: ffff880c2b3d99cc  RBX: ffff880c2b3d9978  RCX: 0000000000000002
     RDX: dead000000100101  RSI: 0000000000000001  RDI: ffffffffffffffe6
     RBP: ffff88062e365c90   R8: ffff88041fe797d8   R9: ffff88062e365d58
     R10: 0000000000000008  R11: 0000000000000000  R12: 0000000000000001
     R13: 0000000000000007  R14: 0000000000000000  R15: 0000000000000000
     ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
  #9 [ffff88062e365c98] __nfs4_file_put_access at ffffffffa0562334 [nfsd]
 #10 [ffff88062e365cc8] nfs4_file_put_access at ffffffffa05623ab [nfsd]
 #11 [ffff88062e365ce8] free_generic_stateid at ffffffffa056634d [nfsd]
 #12 [ffff88062e365d18] release_open_stateid at ffffffffa0566e4b [nfsd]
 #13 [ffff88062e365d38] nfsd4_close at ffffffffa0567401 [nfsd]
 #14 [ffff88062e365d88] nfsd4_proc_compound at ffffffffa0557f28 [nfsd]
 #15 [ffff88062e365dd8] nfsd_dispatch at ffffffffa054543e [nfsd]
 #16 [ffff88062e365e18] svc_process_common at ffffffffa04ba5a4 [sunrpc]
 #17 [ffff88062e365e98] svc_process at ffffffffa04babe0 [sunrpc]
 #18 [ffff88062e365eb8] nfsd at ffffffffa0545b62 [nfsd]
 #19 [ffff88062e365ee8] kthread at ffffffff81090886
 #20 [ffff88062e365f48] kernel_thread at ffffffff8100c14a
------------------------------------------------------------

Cc: [email protected]
Signed-off-by: Harshula Jayasuriya <[email protected]>
Signed-off-by: J. Bruce Fields <[email protected]>
mporsch pushed a commit that referenced this issue Oct 18, 2013
@libin2015
x86/smpboot: Fix announce_cpu() to printk() the last "OK" properly
5223948 
When booting secondary CPUs, announce_cpu() is called to show which cpu has
been brought up. For example:

[    0.402751] smpboot: Booting Node   0, Processors  #1 #2 #3 #4 #5 OK
[    0.525667] smpboot: Booting Node   1, Processors  #6 #7 #8 #9 #10 #11 OK
[    0.755592] smpboot: Booting Node   0, Processors  #12 #13 #14 #15 #16 #17 OK
[    0.890495] smpboot: Booting Node   1, Processors  #18 #19 #20 #21 #22 #23

But the last "OK" is lost, because 'nr_cpu_ids-1' represents the maximum
possible cpu id. It should use the maximum present cpu id in case not all
CPUs booted up.

Signed-off-by: Libin <[email protected]>
Cc: <[email protected]>
Cc: <[email protected]>
Cc: <[email protected]>
Cc: <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
[ tweaked the changelog, removed unnecessary line break, tweaked the format to align the fields vertically. ]
Signed-off-by: Ingo Molnar <[email protected]>
silverjam pushed a commit that referenced this issue Nov 19, 2013
@suryasaimadhu
x86: Improve the printout of the SMP bootup CPU table
646e29a 
As the new x86 CPU bootup printout format code maintainer, I am
taking immediate action to improve and clean (and thus indulge
my OCD) the reporting of the cores when coming up online.

Fix padding to a right-hand alignment, cleanup code and bind
reporting width to the max number of supported CPUs on the
system, like this:

 [    0.074509] smpboot: Booting Node   0, Processors:      #1  #2  #3  #4  #5  #6  #7 OK
 [    0.644008] smpboot: Booting Node   1, Processors:  #8  #9 #10 #11 #12 #13 #14 #15 OK
 [    1.245006] smpboot: Booting Node   2, Processors: #16 #17 #18 #19 #20 #21 #22 #23 OK
 [    1.864005] smpboot: Booting Node   3, Processors: #24 #25 #26 #27 #28 #29 #30 #31 OK
 [    2.489005] smpboot: Booting Node   4, Processors: #32 #33 #34 #35 #36 #37 #38 #39 OK
 [    3.093005] smpboot: Booting Node   5, Processors: #40 #41 #42 #43 #44 #45 #46 #47 OK
 [    3.698005] smpboot: Booting Node   6, Processors: #48 #49 #50 #51 #52 #53 #54 #55 OK
 [    4.304005] smpboot: Booting Node   7, Processors: #56 #57 #58 #59 #60 #61 #62 #63 OK
 [    4.961413] Brought up 64 CPUs

and this:

 [    0.072367] smpboot: Booting Node   0, Processors:    #1 #2 #3 #4 #5 #6 #7 OK
 [    0.686329] Brought up 8 CPUs

Signed-off-by: Borislav Petkov <[email protected]>
Cc: Libin <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>
silverjam pushed a commit that referenced this issue Nov 19, 2013
@bp3tk0v
x86/boot: Further compress CPUs bootup message
a17bce4 
Turn it into (for example):

[    0.073380] x86: Booting SMP configuration:
[    0.074005] .... node   #0, CPUs:          #1   #2   #3   #4   #5   #6   #7
[    0.603005] .... node   #1, CPUs:     #8   #9  #10  #11  #12  #13  #14  #15
[    1.200005] .... node   #2, CPUs:    #16  #17  #18  #19  #20  #21  #22  #23
[    1.796005] .... node   #3, CPUs:    #24  #25  #26  #27  #28  #29  #30  #31
[    2.393005] .... node   #4, CPUs:    #32  #33  #34  #35  #36  #37  #38  #39
[    2.996005] .... node   #5, CPUs:    #40  #41  #42  #43  #44  #45  #46  #47
[    3.600005] .... node   #6, CPUs:    #48  #49  #50  #51  #52  #53  #54  #55
[    4.202005] .... node   #7, CPUs:    #56  #57  #58  #59  #60  #61  #62  #63
[    4.811005] .... node   #8, CPUs:    #64  #65  #66  #67  #68  #69  #70  #71
[    5.421006] .... node   #9, CPUs:    #72  #73  #74  #75  #76  #77  #78  #79
[    6.032005] .... node  #10, CPUs:    #80  #81  #82  #83  #84  #85  #86  #87
[    6.648006] .... node  #11, CPUs:    #88  #89  #90  #91  #92  #93  #94  #95
[    7.262005] .... node  #12, CPUs:    #96  #97  #98  #99 #100 #101 #102 #103
[    7.865005] .... node  #13, CPUs:   #104 #105 #106 #107 #108 #109 #110 #111
[    8.466005] .... node  #14, CPUs:   #112 #113 #114 #115 #116 #117 #118 #119
[    9.073006] .... node  #15, CPUs:   #120 #121 #122 #123 #124 #125 #126 #127
[    9.679901] x86: Booted up 16 nodes, 128 CPUs

and drop useless elements.

Change num_digits() to hpa's division-avoiding, cell-phone-typed
version which he went at great lengths and pains to submit on a
Saturday evening.

Signed-off-by: Borislav Petkov <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: Linus Torvalds <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>
ctwitty pushed a commit that referenced this issue Mar 13, 2014
@ian-abbott @gregkh
staging: comedi: fix bug destroying subdevice files after parent
52ef9e7 
`comedi_free_board_dev()` is called (via `comedi_auto_unconfig()` -->
`comedi_release_hardware_device()`) when an auto-configured comedi
device is removed.  This destroys the main sysfs class device and then
calls `comedi_device_cleanup()` to clean up the comedi device.  For
comedi devices that have comedi subdevices that asynchronous commands,
the clean up involves destroying the sysfs class devices associated with
those subdevices.

There is a bug in the above sequence because the sysfs class devices
associated with the comedi subdevices are children of the sysfs class
device associated with the main comedi device.  Therefore they will have
been automatically destroyed when the main sysfs class device is
destroyed.  When they are destroyed again as part of the clean-up, they
will not be found, leading to a warning and a stack trace similar to
this:

------------[ cut here ]------------
WARNING: CPU: 1 PID: 1213 at fs/sysfs/group.c:214
sysfs_remove_group+0x4e/0xa7()
sysfs group ffffffff817504c0 not found for kobject 'comedi4_subd0'
Modules linked in: nfsd auth_rpcgss oid_registry exportfs nfs_acl lockd
bridge stp llc sunrpc fuse binfmt_misc cpufreq_userspace sr_mod
snd_hda_codec_analog cdrom powernow_k8 kvm_amd kvm amplc_pci230(C)
8255(C) comedi(C) pcmcia xhci_hcd ehci_pci pcmcia_core ohci_pci ohci_hcd
ehci_hcd usbcore snd_hda_intel snd_hda_codec snd_pcm k8temp
snd_page_alloc 8139too snd_timer snd soundcore mii usb_common forcedeth
pata_amd
CPU: 1 PID: 1213 Comm: kworker/u4:6 Tainted: G         C
3.13.0-rc5-ija1+ #20
Hardware name: System manufacturer System Product Name/M2N-E, BIOS ASUS
M2N-E ACPI BIOS Revision 5001 03/23/2010
Workqueue: sysfsd sysfs_schedule_callback_work
 0000000000000000 ffff8800bf17fb38 ffffffff814672ce ffff8800bf17fb80
 ffff8800bf17fb70 ffffffff8103470b ffffffff8114f780 0000000000000000
 ffffffff817504c0 ffff8800bf39f410 ffff880139b68670 ffff8800bf17fbd0
Call Trace:
 [<ffffffff814672ce>] dump_stack+0x45/0x56
 [<ffffffff8103470b>] warn_slowpath_common+0x7a/0x93
 [<ffffffff8114f780>] ? sysfs_remove_group+0x4e/0xa7
 [<ffffffff8103476b>] warn_slowpath_fmt+0x47/0x49
 [<ffffffff8114e92d>] ? sysfs_get_dirent_ns+0x5e/0x66
 [<ffffffff8114f780>] sysfs_remove_group+0x4e/0xa7
 [<ffffffff8132aac0>] dpm_sysfs_remove+0x37/0x3b
 [<ffffffff81323781>] device_del+0x3e/0x173
 [<ffffffff813238c3>] device_unregister+0xd/0x18
 [<ffffffff8132392e>] device_destroy+0x33/0x37
 [<ffffffffa0212086>] comedi_free_subdevice_minor+0x80/0x92 [comedi]
 [<ffffffffa02128bb>] comedi_device_detach+0x79/0x152 [comedi]
 [<ffffffffa020f223>] comedi_device_cleanup+0x36/0x57 [comedi]
 [<ffffffffa020f275>] comedi_free_board_dev+0x31/0x3c [comedi]
 [<ffffffffa0211f2a>] comedi_release_hardware_device+0x5a/0x73 [comedi]
 [<ffffffffa0212547>] comedi_auto_unconfig+0xe/0x10 [comedi]
 [<ffffffffa021357c>] comedi_pci_auto_unconfig+0x10/0x12 [comedi]
 [<ffffffff811d2335>] pci_device_remove+0x40/0x8a
 [<ffffffff813261d0>] __device_release_driver+0x84/0xda
 [<ffffffff81326244>] device_release_driver+0x1e/0x2b
 [<ffffffff811cdcb5>] pci_stop_bus_device+0x44/0x87
 [<ffffffff811cdde2>] pci_stop_and_remove_bus_device+0xd/0x18
 [<ffffffff811d3f3d>] remove_callback+0x20/0x2f
 [<ffffffff8114d1f7>] sysfs_schedule_callback_work+0xf/0x70
 [<ffffffff81049498>] process_one_work+0x1d6/0x34c
 [<ffffffff81049a5f>] worker_thread+0x1cf/0x2b5
 [<ffffffff81049890>] ? rescuer_thread+0x258/0x258
 [<ffffffff8104e0e6>] kthread+0xd6/0xde
 [<ffffffff8104e010>] ? kthread_create_on_node+0x160/0x160
 [<ffffffff81472cbc>] ret_from_fork+0x7c/0xb0
 [<ffffffff8104e010>] ? kthread_create_on_node+0x160/0x160
---[ end trace 94722aa2936a7adf ]---

To correct the bug, rearrange `comedi_free_board_dev()` to destroy the
main sysfs class device *after* the clean-up operation.

Thanks to Bernd Porr for finding the bug and his initial attempt to fix
it.

Reported-by: Bernd Porr <[email protected]>
Signed-off-by: Ian Abbott <[email protected]>
Cc: Bernd Porr <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
ctwitty pushed a commit that referenced this issue Mar 13, 2014
@rostedt @torvalds
SELinux: Fix possible NULL pointer dereference in selinux_inode_permi…
3dc91d4 
…ssion()

While running stress tests on adding and deleting ftrace instances I hit
this bug:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  IP: selinux_inode_permission+0x85/0x160
  PGD 63681067 PUD 7ddbe067 PMD 0
  Oops: 0000 [#1] PREEMPT
  CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted 3.13.0-rc4-test-00033-gd2a6dde-dirty #20
  Hardware name:                  /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
  task: ffff880078375800 ti: ffff88007ddb0000 task.ti: ffff88007ddb0000
  RIP: 0010:[<ffffffff812d8bc5>]  [<ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160
  RSP: 0018:ffff88007ddb1c48  EFLAGS: 00010246
  RAX: 0000000000000000 RBX: 0000000000800000 RCX: ffff88006dd43840
  RDX: 0000000000000001 RSI: 0000000000000081 RDI: ffff88006ee46000
  RBP: ffff88007ddb1c88 R08: 0000000000000000 R09: ffff88007ddb1c54
  R10: 6e6576652f6f6f66 R11: 0000000000000003 R12: 0000000000000000
  R13: 0000000000000081 R14: ffff88006ee46000 R15: 0000000000000000
  FS:  00007f217b5b6700(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033^M
  CR2: 0000000000000020 CR3: 000000006a0fe000 CR4: 00000000000007f0
  Call Trace:
    security_inode_permission+0x1c/0x30
    __inode_permission+0x41/0xa0
    inode_permission+0x18/0x50
    link_path_walk+0x66/0x920
    path_openat+0xa6/0x6c0
    do_filp_open+0x43/0xa0
    do_sys_open+0x146/0x240
    SyS_open+0x1e/0x20
    system_call_fastpath+0x16/0x1b
  Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff
  RIP  selinux_inode_permission+0x85/0x160
  CR2: 0000000000000020

Investigating, I found that the inode->i_security was NULL, and the
dereference of it caused the oops.

in selinux_inode_permission():

	isec = inode->i_security;

	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);

Note, the crash came from stressing the deletion and reading of debugfs
files.  I was not able to recreate this via normal files.  But I'm not
sure they are safe.  It may just be that the race window is much harder
to hit.

What seems to have happened (and what I have traced), is the file is
being opened at the same time the file or directory is being deleted.
As the dentry and inode locks are not held during the path walk, nor is
the inodes ref counts being incremented, there is nothing saving these
structures from being discarded except for an rcu_read_lock().

The rcu_read_lock() protects against freeing of the inode, but it does
not protect freeing of the inode_security_struct.  Now if the freeing of
the i_security happens with a call_rcu(), and the i_security field of
the inode is not changed (it gets freed as the inode gets freed) then
there will be no issue here.  (Linus Torvalds suggested not setting the
field to NULL such that we do not need to check if it is NULL in the
permission check).

Note, this is a hack, but it fixes the problem at hand.  A real fix is
to restructure the destroy_inode() to call all the destructor handlers
from the RCU callback.  But that is a major job to do, and requires a
lot of work.  For now, we just band-aid this bug with this fix (it
works), and work on a more maintainable solution in the future.

Link: http://lkml.kernel.org/r/[email protected]
Link: http://lkml.kernel.org/r/[email protected]

Cc: [email protected]
Signed-off-by: Steven Rostedt <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@twpedersen