[PATCH 0/2] Some fixes to debug_kmap_atomic()

[PATCH 0/2] Some fixes to debug_kmap_atomic()

[Soeren Sandmann]

Hi, 

Here are two patches that fix an issue with debug_kmap_atomic(). 

The first one is a pretty straightforward fix for a race that can
cause an underflow, which in turn causes the stream of warnings to
never end.

The second patch extends debug_kmap_atomic() to deal with KM_IRQ_PTE,
KM_NMI, and KM_NMI_PTE.

I was seeing this because the __get_user_pages_fast() in
arch/x86/kernel/cpu/perf_events.c ends up eventually calling
kmap_atomic() with KM_PTE, which, with CONFIG_HIGHPTE enabled, ends up
expanding to:

#define __KM_PTE                        \
        (in_nmi() ? KM_NMI_PTE :        \
         in_irq() ? KM_IRQ_PTE :        \
         KM_PTE0)

and those KM_* types are not handled 

For the second patch, I am basically pattern matching, so I might be
completely wrong.


Thanks,
Soren

[PATCH 1/2] Fix race in debug_kmap_atomic() which could cause warn_count to underflow

[Soeren Sandmann]

debug_kmap_atomic() tries to prevent ever printing more than 10
warnings, but it does so by testing whether an unsigned integer is
equal to 0. However, if the warning is caused by a nested IRQ, then
this counter may underflow and the stream of warnings will never end.

Fix that by using a signed integer instead.

Signed-off-by: Søren Sandmann Pedersen <sandmann@redhat.com>
---
 mm/highmem.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/highmem.c b/mm/highmem.c
index 25878cc..33587de 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -426,9 +426,9 @@ void __init page_address_init(void)
 
 void debug_kmap_atomic(enum km_type type)
 {
-	static unsigned warn_count = 10;
+	static int warn_count = 10;
 
-	if (unlikely(warn_count == 0))
+	if (unlikely(warn_count < 0))
 		return;
 
 	if (unlikely(in_interrupt())) {
-- 
1.6.5.1

[tip:core/urgent] highmem: Fix race in debug_kmap_atomic() which could cause warn_count to underflow

[tip-bot for Soeren Sandmann]

Commit-ID:  5ebd4c22897dce65845807a9bd3a31cc4e142b53
Gitweb:     http://git.kernel.org/tip/5ebd4c22897dce65845807a9bd3a31cc4e142b53
Author:     Soeren Sandmann <sandmann@daimi.au.dk>
AuthorDate: Wed, 28 Oct 2009 18:55:36 +0100
Committer:  Ingo Molnar <mingo@elte.hu>
CommitDate: Tue, 10 Nov 2009 04:15:32 +0100

highmem: Fix race in debug_kmap_atomic() which could cause warn_count to underflow

debug_kmap_atomic() tries to prevent ever printing more than 10
warnings, but it does so by testing whether an unsigned integer
is equal to 0. However, if the warning is caused by a nested
IRQ, then this counter may underflow and the stream of warnings
will never end.

Fix that by using a signed integer instead.

Signed-off-by: Soeren Sandmann Pedersen <sandmann@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: a.p.zijlstra@chello.nl
Cc: <stable@kernel.org> # .31.x
LKML-Reference: <ye8zl7b8ktj.fsf@camel23.daimi.au.dk>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
 mm/highmem.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/highmem.c b/mm/highmem.c
index 25878cc..33587de 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -426,9 +426,9 @@ void __init page_address_init(void)
 
 void debug_kmap_atomic(enum km_type type)
 {
-	static unsigned warn_count = 10;
+	static int warn_count = 10;
 
-	if (unlikely(warn_count == 0))
+	if (unlikely(warn_count < 0))
 		return;
 
 	if (unlikely(in_interrupt())) {

[PATCH 2/2] Fix debug_kmap_atomic() to also handle KM_IRQ_PTE, KM_NMI, and KM_NMI_PTE

[Soeren Sandmann]

Previously calling debug_kmap_atomic() with these types would cause
spurious warnings.

Signed-off-by: Søren Sandmann Pedersen <sandmann@redhat.com>
---
 mm/highmem.c |   13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/mm/highmem.c b/mm/highmem.c
index 33587de..9c1e627 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -432,10 +432,15 @@ void debug_kmap_atomic(enum km_type type)
 		return;
 
 	if (unlikely(in_interrupt())) {
-		if (in_irq()) {
+		if (in_nmi()) {
+			if (type != KM_NMI && type != KM_NMI_PTE) {
+				WARN_ON(1);
+				warn_count--;
+			}
+		} else if (in_irq()) {
 			if (type != KM_IRQ0 && type != KM_IRQ1 &&
 			    type != KM_BIO_SRC_IRQ && type != KM_BIO_DST_IRQ &&
-			    type != KM_BOUNCE_READ) {
+			    type != KM_BOUNCE_READ && type != KM_IRQ_PTE) {
 				WARN_ON(1);
 				warn_count--;
 			}
@@ -452,7 +457,9 @@ void debug_kmap_atomic(enum km_type type)
 	}
 
 	if (type == KM_IRQ0 || type == KM_IRQ1 || type == KM_BOUNCE_READ ||
-			type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ) {
+			type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ ||
+			type == KM_IRQ_PTE || type == KM_NMI ||
+			type == KM_NMI_PTE ) {
 		if (!irqs_disabled()) {
 			WARN_ON(1);
 			warn_count--;
-- 
1.6.5.1

[tip:core/urgent] highmem: Fix debug_kmap_atomic() to also handle KM_IRQ_PTE, KM_NMI, and KM_NMI_PTE

[tip-bot for Soeren Sandmann]

Commit-ID:  d4515646699b6ad7b1a98ceb871296b957f3ef47
Gitweb:     http://git.kernel.org/tip/d4515646699b6ad7b1a98ceb871296b957f3ef47
Author:     Soeren Sandmann <sandmann@daimi.au.dk>
AuthorDate: Wed, 28 Oct 2009 18:56:35 +0100
Committer:  Ingo Molnar <mingo@elte.hu>
CommitDate: Tue, 10 Nov 2009 04:15:47 +0100

highmem: Fix debug_kmap_atomic() to also handle KM_IRQ_PTE, KM_NMI, and KM_NMI_PTE

Previously calling debug_kmap_atomic() with these types would
cause spurious warnings.

(triggered by SysProf using perf events)

Signed-off-by: Soeren Sandmann Pedersen <sandmann@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: a.p.zijlstra@chello.nl
Cc: <stable@kernel.org> # .31.x
LKML-Reference: <ye8vdhz8krw.fsf@camel23.daimi.au.dk>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
 mm/highmem.c |   13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/mm/highmem.c b/mm/highmem.c
index 33587de..9c1e627 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -432,10 +432,15 @@ void debug_kmap_atomic(enum km_type type)
 		return;
 
 	if (unlikely(in_interrupt())) {
-		if (in_irq()) {
+		if (in_nmi()) {
+			if (type != KM_NMI && type != KM_NMI_PTE) {
+				WARN_ON(1);
+				warn_count--;
+			}
+		} else if (in_irq()) {
 			if (type != KM_IRQ0 && type != KM_IRQ1 &&
 			    type != KM_BIO_SRC_IRQ && type != KM_BIO_DST_IRQ &&
-			    type != KM_BOUNCE_READ) {
+			    type != KM_BOUNCE_READ && type != KM_IRQ_PTE) {
 				WARN_ON(1);
 				warn_count--;
 			}
@@ -452,7 +457,9 @@ void debug_kmap_atomic(enum km_type type)
 	}
 
 	if (type == KM_IRQ0 || type == KM_IRQ1 || type == KM_BOUNCE_READ ||
-			type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ) {
+			type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ ||
+			type == KM_IRQ_PTE || type == KM_NMI ||
+			type == KM_NMI_PTE ) {
 		if (!irqs_disabled()) {
 			WARN_ON(1);
 			warn_count--;

Re: [PATCH 0/2] Some fixes to debug_kmap_atomic()

[Ingo Molnar]

* Soeren Sandmann <sandmann@daimi.au.dk> wrote:

> Hi, 
> 
> Here are two patches that fix an issue with debug_kmap_atomic(). 

hm, have you seen this patch from Peter on lkml:

  [RFC][PATCH] kmap_atomic_push

which eliminates debug_kmap_atomic().

	Ingo

Re: [PATCH 0/2] Some fixes to debug_kmap_atomic()

[Soeren Sandmann]

Ingo Molnar <mingo@elte.hu> writes:

> hm, have you seen this patch from Peter on lkml:
> 
>   [RFC][PATCH] kmap_atomic_push
> 
> which eliminates debug_kmap_atomic().

I hadn't; that would work as well, though fixing the infinite stream
of warning is maybe embarrassing enough that it should be in 2.6.32?


Soren