From: Vishal Verma <vishal.l.verma@intel.com>
To: Dan Williams <dan.j.williams@intel.com>
Cc: linux-nvdimm@lists.01.org, stable@vger.kernel.org,
linux-acpi@vger.kernel.org
Subject: Re: [PATCH] acpi, nfit: fix acpi_nfit_flush_probe() crash
Date: Thu, 2 Feb 2017 13:34:19 -0700 [thread overview]
Message-ID: <20170202203418.GC14128@omniknight.lm.intel.com> (raw)
In-Reply-To: <148606158246.11883.8248896172906265924.stgit@dwillia2-desk3.amr.corp.intel.com>
On 02/02, Dan Williams wrote:
> We queue an on-stack work item to 'nfit_wq' and wait for it to complete
> as part of a 'flush_probe' request. However, if the user cancels the
> wait we need to make sure the item is flushed from the queue otherwise
> we are leaving an out-of-scope stack address on the work list.
>
> BUG: unable to handle kernel paging request at ffffbcb3c72f7cd0
> IP: [<ffffffffa9413a7b>] __list_add+0x1b/0xb0
> [..]
> RIP: 0010:[<ffffffffa9413a7b>] [<ffffffffa9413a7b>] __list_add+0x1b/0xb0
> RSP: 0018:ffffbcb3c7ba7c00 EFLAGS: 00010046
> [..]
> Call Trace:
> [<ffffffffa90bb11a>] insert_work+0x3a/0xc0
> [<ffffffffa927fdda>] ? seq_open+0x5a/0xa0
> [<ffffffffa90bb30a>] __queue_work+0x16a/0x460
> [<ffffffffa90bbb08>] queue_work_on+0x38/0x40
> [<ffffffffc0cf2685>] acpi_nfit_flush_probe+0x95/0xc0 [nfit]
> [<ffffffffc0cf25d0>] ? nfit_visible+0x40/0x40 [nfit]
> [<ffffffffa9571495>] wait_probe_show+0x25/0x60
> [<ffffffffa9546b30>] dev_attr_show+0x20/0x50
>
> Fixes: 7ae0fa439faf ("nfit, libnvdimm: async region scrub workqueue")
> Cc: <stable@vger.kernel.org>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
> drivers/acpi/nfit/core.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
Looks good to me.
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
>
> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> index 2f82b8eba360..7361d00818e2 100644
> --- a/drivers/acpi/nfit/core.c
> +++ b/drivers/acpi/nfit/core.c
> @@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
> struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
> struct device *dev = acpi_desc->dev;
> struct acpi_nfit_flush_work flush;
> + int rc;
>
> /* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
> device_lock(dev);
> @@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
> INIT_WORK_ONSTACK(&flush.work, flush_probe);
> COMPLETION_INITIALIZER_ONSTACK(flush.cmp);
> queue_work(nfit_wq, &flush.work);
> - return wait_for_completion_interruptible(&flush.cmp);
> +
> + rc = wait_for_completion_interruptible(&flush.cmp);
> + cancel_work_sync(&flush.work);
> + return rc;
> }
>
> static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
>
WARNING: multiple messages have this Message-ID (diff)
From: Vishal Verma <vishal.l.verma@intel.com>
To: Dan Williams <dan.j.williams@intel.com>
Cc: linux-acpi@vger.kernel.org, stable@vger.kernel.org,
linux-nvdimm@lists.01.org
Subject: Re: [PATCH] acpi, nfit: fix acpi_nfit_flush_probe() crash
Date: Thu, 2 Feb 2017 13:34:19 -0700 [thread overview]
Message-ID: <20170202203418.GC14128@omniknight.lm.intel.com> (raw)
In-Reply-To: <148606158246.11883.8248896172906265924.stgit@dwillia2-desk3.amr.corp.intel.com>
On 02/02, Dan Williams wrote:
> We queue an on-stack work item to 'nfit_wq' and wait for it to complete
> as part of a 'flush_probe' request. However, if the user cancels the
> wait we need to make sure the item is flushed from the queue otherwise
> we are leaving an out-of-scope stack address on the work list.
>
> BUG: unable to handle kernel paging request at ffffbcb3c72f7cd0
> IP: [<ffffffffa9413a7b>] __list_add+0x1b/0xb0
> [..]
> RIP: 0010:[<ffffffffa9413a7b>] [<ffffffffa9413a7b>] __list_add+0x1b/0xb0
> RSP: 0018:ffffbcb3c7ba7c00 EFLAGS: 00010046
> [..]
> Call Trace:
> [<ffffffffa90bb11a>] insert_work+0x3a/0xc0
> [<ffffffffa927fdda>] ? seq_open+0x5a/0xa0
> [<ffffffffa90bb30a>] __queue_work+0x16a/0x460
> [<ffffffffa90bbb08>] queue_work_on+0x38/0x40
> [<ffffffffc0cf2685>] acpi_nfit_flush_probe+0x95/0xc0 [nfit]
> [<ffffffffc0cf25d0>] ? nfit_visible+0x40/0x40 [nfit]
> [<ffffffffa9571495>] wait_probe_show+0x25/0x60
> [<ffffffffa9546b30>] dev_attr_show+0x20/0x50
>
> Fixes: 7ae0fa439faf ("nfit, libnvdimm: async region scrub workqueue")
> Cc: <stable@vger.kernel.org>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
> drivers/acpi/nfit/core.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
Looks good to me.
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
>
> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> index 2f82b8eba360..7361d00818e2 100644
> --- a/drivers/acpi/nfit/core.c
> +++ b/drivers/acpi/nfit/core.c
> @@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
> struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
> struct device *dev = acpi_desc->dev;
> struct acpi_nfit_flush_work flush;
> + int rc;
>
> /* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
> device_lock(dev);
> @@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
> INIT_WORK_ONSTACK(&flush.work, flush_probe);
> COMPLETION_INITIALIZER_ONSTACK(flush.cmp);
> queue_work(nfit_wq, &flush.work);
> - return wait_for_completion_interruptible(&flush.cmp);
> +
> + rc = wait_for_completion_interruptible(&flush.cmp);
> + cancel_work_sync(&flush.work);
> + return rc;
> }
>
> static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
>
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm
next prev parent reply other threads:[~2017-02-02 20:34 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-02 18:53 [PATCH] acpi, nfit: fix acpi_nfit_flush_probe() crash Dan Williams
2017-02-02 18:53 ` Dan Williams
2017-02-02 20:34 ` Vishal Verma [this message]
2017-02-02 20:34 ` Vishal Verma
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170202203418.GC14128@omniknight.lm.intel.com \
--to=vishal.l.verma@intel.com \
--cc=dan.j.williams@intel.com \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-nvdimm@lists.01.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.