* [PATCH RT 1/5] arm: kprobe: replace patch_lock to raw lock
2017-02-09 15:32 [PATCH RT 0/5] Linux 4.1.38-rt45-rc1 Steven Rostedt
@ 2017-02-09 15:32 ` Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 2/5] net: free the sbs in skbufhead Steven Rostedt
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Steven Rostedt @ 2017-02-09 15:32 UTC (permalink / raw)
To: linux-kernel, linux-rt-users
Cc: Thomas Gleixner, Carsten Emde, Sebastian Andrzej Siewior,
John Kacur, Paul Gortmaker, Yang Shi
[-- Attachment #1: 0001-arm-kprobe-replace-patch_lock-to-raw-lock.patch --]
[-- Type: text/plain, Size: 3043 bytes --]
4.1.38-rt45-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: Yang Shi <yang.shi@linaro.org>
When running kprobe on -rt kernel, the below bug is caught:
BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:931
in_atomic(): 1, irqs_disabled(): 128, pid: 14, name: migration/0
INFO: lockdep is turned off.
irq event stamp: 238
hardirqs last enabled at (237): [<80b5aecc>] _raw_spin_unlock_irqrestore+0x88/0x90
hardirqs last disabled at (238): [<80b56d88>] __schedule+0xec/0x94c
softirqs last enabled at (0): [<80225584>] copy_process.part.5+0x30c/0x1994
softirqs last disabled at (0): [< (null)>] (null)
Preemption disabled at:[<802f2b98>] cpu_stopper_thread+0xc0/0x140
CPU: 0 PID: 14 Comm: migration/0 Tainted: G O 4.8.3-rt2 #1
Hardware name: Freescale LS1021A
[<80212e7c>] (unwind_backtrace) from [<8020cd2c>] (show_stack+0x20/0x24)
[<8020cd2c>] (show_stack) from [<80689e14>] (dump_stack+0xa0/0xcc)
[<80689e14>] (dump_stack) from [<8025a43c>] (___might_sleep+0x1b8/0x2a4)
[<8025a43c>] (___might_sleep) from [<80b5b324>] (rt_spin_lock+0x34/0x74)
[<80b5b324>] (rt_spin_lock) from [<80b5c31c>] (__patch_text_real+0x70/0xe8)
[<80b5c31c>] (__patch_text_real) from [<80b5c3ac>] (patch_text_stop_machine+0x18/0x20)
[<80b5c3ac>] (patch_text_stop_machine) from [<802f2920>] (multi_cpu_stop+0xfc/0x134)
[<802f2920>] (multi_cpu_stop) from [<802f2ba0>] (cpu_stopper_thread+0xc8/0x140)
[<802f2ba0>] (cpu_stopper_thread) from [<802563a4>] (smpboot_thread_fn+0x1a4/0x354)
[<802563a4>] (smpboot_thread_fn) from [<80251d38>] (kthread+0x104/0x11c)
[<80251d38>] (kthread) from [<80207f70>] (ret_from_fork+0x14/0x24)
Since patch_text_stop_machine() is called in stop_machine() which disables IRQ,
sleepable lock should be not used in this atomic context, so replace patch_lock
to raw lock.
Signed-off-by: Yang Shi <yang.shi@linaro.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
arch/arm/kernel/patch.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c
index 69bda1a5707e..1f665acaa6a9 100644
--- a/arch/arm/kernel/patch.c
+++ b/arch/arm/kernel/patch.c
@@ -15,7 +15,7 @@ struct patch {
unsigned int insn;
};
-static DEFINE_SPINLOCK(patch_lock);
+static DEFINE_RAW_SPINLOCK(patch_lock);
static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
__acquires(&patch_lock)
@@ -32,7 +32,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
return addr;
if (flags)
- spin_lock_irqsave(&patch_lock, *flags);
+ raw_spin_lock_irqsave(&patch_lock, *flags);
else
__acquire(&patch_lock);
@@ -47,7 +47,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags)
clear_fixmap(fixmap);
if (flags)
- spin_unlock_irqrestore(&patch_lock, *flags);
+ raw_spin_unlock_irqrestore(&patch_lock, *flags);
else
__release(&patch_lock);
}
--
2.10.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 2/5] net: free the sbs in skbufhead
2017-02-09 15:32 [PATCH RT 0/5] Linux 4.1.38-rt45-rc1 Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 1/5] arm: kprobe: replace patch_lock to raw lock Steven Rostedt
@ 2017-02-09 15:32 ` Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 3/5] net: Have __napi_schedule_irqoff() disable interrupts on RT Steven Rostedt
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Steven Rostedt @ 2017-02-09 15:32 UTC (permalink / raw)
To: linux-kernel, linux-rt-users
Cc: Thomas Gleixner, Carsten Emde, Sebastian Andrzej Siewior,
John Kacur, Paul Gortmaker, stable
[-- Attachment #1: 0002-net-free-the-sbs-in-skbufhead.patch --]
[-- Type: text/plain, Size: 1215 bytes --]
4.1.38-rt45-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
In "skbufhead-raw-lock.patch" we moved the memory to a list and the hunk that
cleared the list got misplaced.
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
net/core/dev.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index f1c1a198d4b7..6b2436f0fc66 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4764,13 +4764,21 @@ static void net_rx_action(struct softirq_action *h)
struct softnet_data *sd = this_cpu_ptr(&softnet_data);
unsigned long time_limit = jiffies + 2;
int budget = netdev_budget;
+ struct sk_buff_head tofree_q;
+ struct sk_buff *skb;
LIST_HEAD(list);
LIST_HEAD(repoll);
+ __skb_queue_head_init(&tofree_q);
+
local_irq_disable();
+ skb_queue_splice_init(&sd->tofree_queue, &tofree_q);
list_splice_init(&sd->poll_list, &list);
local_irq_enable();
+ while ((skb = __skb_dequeue(&tofree_q)))
+ kfree_skb(skb);
+
for (;;) {
struct napi_struct *n;
--
2.10.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 3/5] net: Have __napi_schedule_irqoff() disable interrupts on RT
2017-02-09 15:32 [PATCH RT 0/5] Linux 4.1.38-rt45-rc1 Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 1/5] arm: kprobe: replace patch_lock to raw lock Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 2/5] net: free the sbs in skbufhead Steven Rostedt
@ 2017-02-09 15:32 ` Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 4/5] workqueue: use rcu_readlock() in put_pwq_unlocked() Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 5/5] Linux 4.1.38-rt45-rc1 Steven Rostedt
4 siblings, 0 replies; 6+ messages in thread
From: Steven Rostedt @ 2017-02-09 15:32 UTC (permalink / raw)
To: linux-kernel, linux-rt-users
Cc: Thomas Gleixner, Carsten Emde, Sebastian Andrzej Siewior,
John Kacur, Paul Gortmaker, stable-rt
[-- Attachment #1: 0003-net-Have-__napi_schedule_irqoff-disable-interrupts-o.patch --]
[-- Type: text/plain, Size: 2732 bytes --]
4.1.38-rt45-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
A customer hit a crash where the napi sd->poll_list became corrupted.
The customer had the bnx2x driver, which does a
__napi_schedule_irqoff() in its interrupt handler. Unfortunately, when
running with CONFIG_PREEMPT_RT_FULL, this interrupt handler is run as a
thread and is preemptable. The call to ____napi_schedule() must be done
with interrupts disabled to protect the per cpu softnet_data's
"poll_list, which is protected by disabling interrupts (disabling
preemption is enough when all interrupts are threaded and
local_bh_disable() can't preempt)."
As bnx2x isn't the only driver that does this, the safest thing to do
is to make __napi_schedule_irqoff() call __napi_schedule() instead when
CONFIG_PREEMPT_RT_FULL is enabled, which will call local_irq_save()
before calling ____napi_schedule().
Cc: stable-rt@vger.kernel.org
Signed-off-by: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
include/linux/netdevice.h | 12 ++++++++++++
net/core/dev.c | 2 ++
2 files changed, 14 insertions(+)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index c033d226fca3..336725583223 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -390,7 +390,19 @@ typedef enum rx_handler_result rx_handler_result_t;
typedef rx_handler_result_t rx_handler_func_t(struct sk_buff **pskb);
void __napi_schedule(struct napi_struct *n);
+
+/*
+ * When PREEMPT_RT_FULL is defined, all device interrupt handlers
+ * run as threads, and they can also be preempted (without PREEMPT_RT
+ * interrupt threads can not be preempted). Which means that calling
+ * __napi_schedule_irqoff() from an interrupt handler can be preempted
+ * and can corrupt the napi->poll_list.
+ */
+#ifdef CONFIG_PREEMPT_RT_FULL
+#define __napi_schedule_irqoff(n) __napi_schedule(n)
+#else
void __napi_schedule_irqoff(struct napi_struct *n);
+#endif
static inline bool napi_disable_pending(struct napi_struct *n)
{
diff --git a/net/core/dev.c b/net/core/dev.c
index 6b2436f0fc66..fc74ea6d8b63 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4529,6 +4529,7 @@ void __napi_schedule(struct napi_struct *n)
}
EXPORT_SYMBOL(__napi_schedule);
+#ifndef CONFIG_PREEMPT_RT_FULL
/**
* __napi_schedule_irqoff - schedule for receive
* @n: entry to schedule
@@ -4540,6 +4541,7 @@ void __napi_schedule_irqoff(struct napi_struct *n)
____napi_schedule(this_cpu_ptr(&softnet_data), n);
}
EXPORT_SYMBOL(__napi_schedule_irqoff);
+#endif
void __napi_complete(struct napi_struct *n)
{
--
2.10.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 4/5] workqueue: use rcu_readlock() in put_pwq_unlocked()
2017-02-09 15:32 [PATCH RT 0/5] Linux 4.1.38-rt45-rc1 Steven Rostedt
` (2 preceding siblings ...)
2017-02-09 15:32 ` [PATCH RT 3/5] net: Have __napi_schedule_irqoff() disable interrupts on RT Steven Rostedt
@ 2017-02-09 15:32 ` Steven Rostedt
2017-02-09 15:32 ` [PATCH RT 5/5] Linux 4.1.38-rt45-rc1 Steven Rostedt
4 siblings, 0 replies; 6+ messages in thread
From: Steven Rostedt @ 2017-02-09 15:32 UTC (permalink / raw)
To: linux-kernel, linux-rt-users
Cc: Thomas Gleixner, Carsten Emde, Sebastian Andrzej Siewior,
John Kacur, Paul Gortmaker, stable-rt, John Keeping
[-- Attachment #1: 0004-workqueue-use-rcu_readlock-in-put_pwq_unlocked.patch --]
[-- Type: text/plain, Size: 2427 bytes --]
4.1.38-rt45-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
The RCU sched protection was changed to RCU only and so all IRQ-off and
preempt-off disabled region were changed to the relevant rcu-read-lock
primitives. One was missed and triggered:
|[ BUG: bad unlock balance detected! ]
|4.4.30-rt41 #51 Tainted: G W
|btattach/345 is trying to release lock (
|Unable to handle kernel paging request at virtual address 6b6b6bbb
|Backtrace:
|[<c016b5a0>] (lock_release) from [<c0804844>] (rt_spin_unlock+0x20/0x30)
|[<c0804824>] (rt_spin_unlock) from [<c0138954>] (put_pwq_unlocked+0xa4/0x118)
|[<c01388b0>] (put_pwq_unlocked) from [<c0138b2c>] (destroy_workqueue+0x164/0x1b0)
|[<c01389c8>] (destroy_workqueue) from [<c078e1ac>] (hci_unregister_dev+0x120/0x21c)
|[<c078e08c>] (hci_unregister_dev) from [<c054f658>] (hci_uart_tty_close+0x90/0xbc)
|[<c054f5c8>] (hci_uart_tty_close) from [<c03a2be8>] (tty_ldisc_close+0x50/0x58)
|[<c03a2b98>] (tty_ldisc_close) from [<c03a2cb4>] (tty_ldisc_kill+0x18/0x78)
|[<c03a2c9c>] (tty_ldisc_kill) from [<c03a3528>] (tty_ldisc_release+0x100/0x134)
|[<c03a3428>] (tty_ldisc_release) from [<c039cd68>] (tty_release+0x3bc/0x460)
|[<c039c9ac>] (tty_release) from [<c020cc08>] (__fput+0xe0/0x1b4)
|[<c020cb28>] (__fput) from [<c020cd3c>] (____fput+0x10/0x14)
|[<c020cd2c>] (____fput) from [<c013e0d4>] (task_work_run+0xa4/0xb8)
|[<c013e030>] (task_work_run) from [<c0121754>] (do_exit+0x40c/0x8b0)
|[<c0121348>] (do_exit) from [<c0122ff8>] (do_group_exit+0x54/0xc4)
Cc: stable-rt@vger.kernel.org
Reported-by: John Keeping <john@metanate.com>
Tested-by: John Keeping <john@metanate.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
kernel/workqueue.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 80f3bb082136..bb994a4e0fe2 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1139,9 +1139,11 @@ static void put_pwq_unlocked(struct pool_workqueue *pwq)
* As both pwqs and pools are RCU protected, the
* following lock operations are safe.
*/
+ rcu_read_lock();
local_spin_lock_irq(pendingb_lock, &pwq->pool->lock);
put_pwq(pwq);
local_spin_unlock_irq(pendingb_lock, &pwq->pool->lock);
+ rcu_read_unlock();
}
}
--
2.10.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 5/5] Linux 4.1.38-rt45-rc1
2017-02-09 15:32 [PATCH RT 0/5] Linux 4.1.38-rt45-rc1 Steven Rostedt
` (3 preceding siblings ...)
2017-02-09 15:32 ` [PATCH RT 4/5] workqueue: use rcu_readlock() in put_pwq_unlocked() Steven Rostedt
@ 2017-02-09 15:32 ` Steven Rostedt
4 siblings, 0 replies; 6+ messages in thread
From: Steven Rostedt @ 2017-02-09 15:32 UTC (permalink / raw)
To: linux-kernel, linux-rt-users
Cc: Thomas Gleixner, Carsten Emde, Sebastian Andrzej Siewior,
John Kacur, Paul Gortmaker
[-- Attachment #1: 0005-Linux-4.1.38-rt45-rc1.patch --]
[-- Type: text/plain, Size: 412 bytes --]
4.1.38-rt45-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
---
localversion-rt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/localversion-rt b/localversion-rt
index ac4d836a809d..e6421b58f4c8 100644
--- a/localversion-rt
+++ b/localversion-rt
@@ -1 +1 @@
--rt44
+-rt45-rc1
--
2.10.2
^ permalink raw reply related [flat|nested] 6+ messages in thread