[PATCH 0/2] [GIT PULL][v3.5] ring-buffer: Fixes for the changes in the last merge window

[PATCH 0/2] [GIT PULL][v3.5] ring-buffer: Fixes for the changes in the last merge window

[Steven Rostedt]

[-- Attachment #1: Type: text/plain, Size: 1186 bytes --]


Ingo,

This patch series has a couple of fixes for bugs that snuck into the last
merge window. The first is a crash that can happen because of an
uninitialized list, and failing to allocate the requested amount. This
can happen by changing the buffer_size_kb to a huge amount as the first
change that is done to it after booting up (note, the bug does not happen
if a successful change happens first).

The second patch can cause the ring buffer accounting (which is used by
the infrastructure of the ring buffer) to get out of sync. This happens
if you fill the buffer and then remove a few pages from it while it
is full.

The fixes are pretty simple, and should go into the 3.5-rc.

Please pull the latest tip/perf/urgent tree, which can be found at:

  git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
tip/perf/urgent

Head SHA1: 48fdc72f23ad9a9956e524a47843135d0bbc3317


Vaibhav Nagarnaik (2):
      ring-buffer: Fix crash due to uninitialized new_pages list head
      ring-buffer: Fix accounting of entries when removing pages

----
 kernel/trace/ring_buffer.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[PATCH 1/2] ring-buffer: Fix crash due to uninitialized new_pages list head

[Steven Rostedt]

[-- Attachment #1: Type: text/plain, Size: 1288 bytes --]

From: Vaibhav Nagarnaik <vnagarnaik@google.com>

The new_pages list head in the cpu_buffer is not initialized. When
adding pages to the ring buffer, if the memory allocation fails in
ring_buffer_resize, the clean up handler tries to free up the allocated
pages from all the cpu buffers. The panic is caused by referencing the
uninitialized new_pages list head.

Initializing the new_pages list head in rb_allocate_cpu_buffer fixes
this.

Link: http://lkml.kernel.org/r/1340391005-10880-1-git-send-email-vnagarnaik@google.com

Cc: Justin Teravest <teravest@google.com>
Cc: David Sharp <dhsharp@google.com>
Signed-off-by: Vaibhav Nagarnaik <vnagarnaik@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/ring_buffer.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 1d0f6a8..ba39cba 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1075,6 +1075,7 @@ rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu)
 	rb_init_page(bpage->page);
 
 	INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
+	INIT_LIST_HEAD(&cpu_buffer->new_pages);
 
 	ret = rb_allocate_pages(cpu_buffer, nr_pages);
 	if (ret < 0)
-- 
1.7.10



[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[PATCH 2/2] ring-buffer: Fix accounting of entries when removing pages

[Steven Rostedt]

[-- Attachment #1: Type: text/plain, Size: 1447 bytes --]

From: Vaibhav Nagarnaik <vnagarnaik@google.com>

When removing pages from the ring buffer, its state is not reset. This
means that the counters need to be correctly updated to account for the
pages removed.

Update the overrun counter to reflect the removed events from the pages.

Link: http://lkml.kernel.org/r/1340998301-1715-1-git-send-email-vnagarnaik@google.com

Cc: Justin Teravest <teravest@google.com>
Cc: David Sharp <dhsharp@google.com>
Signed-off-by: Vaibhav Nagarnaik <vnagarnaik@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/ring_buffer.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index ba39cba..f765465 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1347,10 +1347,9 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages)
 			 * If something was added to this page, it was full
 			 * since it is not the tail page. So we deduct the
 			 * bytes consumed in ring buffer from here.
-			 * No need to update overruns, since this page is
-			 * deleted from ring buffer and its entries are
-			 * already accounted for.
+			 * Increment overrun to account for the lost events.
 			 */
+			local_add(page_entries, &cpu_buffer->overrun);
 			local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes);
 		}
 
-- 
1.7.10



[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [PATCH 0/2] [GIT PULL][v3.5] ring-buffer: Fixes for the changes in the last merge window

[Ingo Molnar]

* Steven Rostedt <rostedt@goodmis.org> wrote:

> Ingo,
> 
> This patch series has a couple of fixes for bugs that snuck 
> into the last merge window. The first is a crash that can 
> happen because of an uninitialized list, and failing to 
> allocate the requested amount. This can happen by changing the 
> buffer_size_kb to a huge amount as the first change that is 
> done to it after booting up (note, the bug does not happen if 
> a successful change happens first).
> 
> The second patch can cause the ring buffer accounting (which 
> is used by the infrastructure of the ring buffer) to get out 
> of sync. This happens if you fill the buffer and then remove a 
> few pages from it while it is full.
> 
> The fixes are pretty simple, and should go into the 3.5-rc.
> 
> Please pull the latest tip/perf/urgent tree, which can be found at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
> tip/perf/urgent
> 
> Head SHA1: 48fdc72f23ad9a9956e524a47843135d0bbc3317
> 
> 
> Vaibhav Nagarnaik (2):
>       ring-buffer: Fix crash due to uninitialized new_pages list head
>       ring-buffer: Fix accounting of entries when removing pages
> 
> ----
>  kernel/trace/ring_buffer.c |    6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)

Pulled, thanks!

	Ingo