From: Guenter Roeck <linux@roeck-us.net>
To: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>, linux-kernel@vger.kernel.org
Subject: next: runtime warning after 'locking/refcounts: Out-of-line everything'
Date: Mon, 27 Feb 2017 13:47:47 -0800 [thread overview]
Message-ID: <20170227214747.GA30307@roeck-us.net> (raw)
Hi Peter,
I see the following runtime warning when running a 44x/virtex5_defconfig
image in qemu (virtex-ml507).
refcount_t: underflow; use-after-free.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at lib/refcount.c:128 refcount_sub_and_test+0x90/0xd0
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 4.10.0-next-20170227 #1
task: cf81d5a0 task.stack: cf81e000
NIP: c02100e0 LR: c02100e0 CTR: c0279970
REGS: cf81fc90 TRAP: 0700 Not tainted (4.10.0-next-20170227)
MSR: 00029000 <CE,EE,ME>
CR: 24000022 XER: 00000000
GPR00: c02100e0 cf81fd40 cf81d5a0 00000026 00000000 00000000 c027a3d0 00000000
GPR08: c05403bc 00000800 00000000 00000000 24000024 00000000 c0001ad0 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 c054b3c0 c0550000
GPR24: 00000000 00000000 cf948010 00000015 00000000 00000000 cf948000 cfb1c0e8
NIP [c02100e0] refcount_sub_and_test+0x90/0xd0
LR [c02100e0] refcount_sub_and_test+0x90/0xd0
Call Trace:
[cf81fd40] [c02100e0] refcount_sub_and_test+0x90/0xd0 (unreliable)
[cf81fd50] [c01f6564] kobject_put+0x34/0x90
[cf81fd60] [c02ac240] ace_probe+0x410/0x450
[cf81fda0] [c0293684] platform_drv_probe+0x44/0xc0
[cf81fdc0] [c0291494] driver_probe_device+0x234/0x340
[cf81fdf0] [c029166c] __driver_attach+0xcc/0xd0
[cf81fe10] [c028eff8] bus_for_each_dev+0x68/0xc0
[cf81fe40] [c0290838] bus_add_driver+0x208/0x280
[cf81fe60] [c0292198] driver_register+0x88/0x140
[cf81fe70] [c050be10] ace_init+0x48/0xa4
[cf81fe90] [c0001350] do_one_initcall+0x40/0x180
[cf81fef0] [c04f2ae0] kernel_init_freeable+0x134/0x1cc
[cf81ff30] [c0001ae4] kernel_init+0x14/0x110
[cf81ff40] [c000c3d0] ret_from_kernel_thread+0x5c/0x64
Instruction dump:
40a2fff0 7f884840 7d094378 419e0044 2f89ffff 7d434850 7f0a4840 419e0018
4099ffd0 3c60c04b 386393f0 4820e99d <0fe00000> 80010014 38600000 38210010
---[ end trace 17bd7014e44a5b26 ]---
xsysace 83600000.sysace: xsysace: error initializing device at 0x83600000
xsysace 83600000.sysace: could not initialize device, err=-12
xsysace: probe of 83600000.sysace failed with error -12
Xilinx SystemACE device driver, major=254
The complete log is available at
http://kerneltests.org/builders/qemu-ppc-next/builds/590/steps/qemubuildcommand/logs/stdio
Bisect points to commit 29dee3c03abc ("locking/refcounts: Out-of-line
everything'); bisect log is attached. Reverting this commit fixes the problem.
Please let me know if there is anything I can do to help tracking down the
problem.
[ Maybe there is a bug in the ace driver's error handler, but why is it only
seen with your patch applied ? ]
Guenter
---
# bad: [2b9bda0679b5b4481396190d2f482fb9b31984f5] Revert "objtool: Improve detection of BUG() and other dead ends"
# good: [c470abd4fde40ea6a0846a2beab642a578c0b8cd] Linux 4.10
git bisect start 'HEAD' 'v4.10'
# good: [caa59428971d5ad81d19512365c9ba580d83268c] Merge tag 'staging-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
git bisect good caa59428971d5ad81d19512365c9ba580d83268c
# good: [d5500a074741b78b7f778b4ab3415d5ecdcda0a7] Merge tag 'usercopy-v4.11-rc1.fix' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
git bisect good d5500a074741b78b7f778b4ab3415d5ecdcda0a7
# good: [5d8a00eee2ed2e548a5d21b0edf495f3f7bf8bb4] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
git bisect good 5d8a00eee2ed2e548a5d21b0edf495f3f7bf8bb4
# good: [017bfb6c372fa793cdb09828597a464fa24e0ea7] Merge remote-tracking branch 'jfs/jfs-next'
git bisect good 017bfb6c372fa793cdb09828597a464fa24e0ea7
# bad: [e2a95a3fe9e9586df29e8d673dc8cdd36ed6158b] Merge remote-tracking branch 'edac/linux_next'
git bisect bad e2a95a3fe9e9586df29e8d673dc8cdd36ed6158b
# good: [736e441efdafdbf0bb32732d87e00b8ba7f75260] Merge remote-tracking branch 'thermal/next'
git bisect good 736e441efdafdbf0bb32732d87e00b8ba7f75260
# good: [5bd695c24b294b482d86d352a4a0c7ba2059dcff] Merge remote-tracking branch 'block/for-next'
git bisect good 5bd695c24b294b482d86d352a4a0c7ba2059dcff
# good: [690962e72babac64c8240071e106d2c3e8d08306] Merge remote-tracking branch 'spi/for-next'
git bisect good 690962e72babac64c8240071e106d2c3e8d08306
# bad: [462a53b1a2f984a8c8c0aade1c461ce9ea156d5b] Merge branch 'perf/urgent'
git bisect bad 462a53b1a2f984a8c8c0aade1c461ce9ea156d5b
# good: [bb963e16507ca7670f0bb47ccaada8874b2ba6a1] perf utils: Check verbose flag properly
git bisect good bb963e16507ca7670f0bb47ccaada8874b2ba6a1
# good: [7bbba0eb1af34694868d028b80475981f90e6bee] perf/core: Fix perf_event_enable_on_exec() timekeeping (again)
git bisect good 7bbba0eb1af34694868d028b80475981f90e6bee
# good: [1db159781cc7df093085ccaddc022beaaa9dd990] Merge branch 'core/urgent'
git bisect good 1db159781cc7df093085ccaddc022beaaa9dd990
# bad: [318b1dedcd39012624f466d281627553e9fa2570] locking/refcounts: Add missing kernel.h header to have UINT_MAX defined
git bisect bad 318b1dedcd39012624f466d281627553e9fa2570
# bad: [29dee3c03abce04cd527878ef5f9e5f91b7b83f4] locking/refcounts: Out-of-line everything
git bisect bad 29dee3c03abce04cd527878ef5f9e5f91b7b83f4
# first bad commit: [29dee3c03abce04cd527878ef5f9e5f91b7b83f4] locking/refcounts: Out-of-line everything
next reply other threads:[~2017-02-27 21:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-27 21:47 Guenter Roeck [this message]
2017-02-28 7:52 ` next: runtime warning after 'locking/refcounts: Out-of-line everything' Peter Zijlstra
2017-02-28 15:05 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170227214747.GA30307@roeck-us.net \
--to=linux@roeck-us.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.