From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>,
Sasha Levin <sashal@kernel.org>,
linux-afs@lists.infradead.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.3 19/99] rxrpc: Fix trace-after-put looking at the put call record
Date: Sat, 26 Oct 2019 09:14:40 -0400 [thread overview]
Message-ID: <20191026131600.2507-19-sashal@kernel.org> (raw)
In-Reply-To: <20191026131600.2507-1-sashal@kernel.org>
From: David Howells <dhowells@redhat.com>
[ Upstream commit 48c9e0ec7cbbb7370448f859ccc8e3b7eb69e755 ]
rxrpc_put_call() calls trace_rxrpc_call() after it has done the decrement
of the refcount - which looks at the debug_id in the call record. But
unless the refcount was reduced to zero, we no longer have the right to
look in the record and, indeed, it may be deleted by some other thread.
Fix this by getting the debug_id out before decrementing the refcount and
then passing that into the tracepoint.
Fixes: e34d4234b0b7 ("rxrpc: Trace rxrpc_call usage")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/rxrpc.h | 6 +++---
net/rxrpc/call_accept.c | 2 +-
net/rxrpc/call_object.c | 28 +++++++++++++++++-----------
3 files changed, 21 insertions(+), 15 deletions(-)
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 38a97e890cb67..191fe447f9908 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -606,10 +606,10 @@ TRACE_EVENT(rxrpc_client,
);
TRACE_EVENT(rxrpc_call,
- TP_PROTO(struct rxrpc_call *call, enum rxrpc_call_trace op,
+ TP_PROTO(unsigned int call_debug_id, enum rxrpc_call_trace op,
int usage, const void *where, const void *aux),
- TP_ARGS(call, op, usage, where, aux),
+ TP_ARGS(call_debug_id, op, usage, where, aux),
TP_STRUCT__entry(
__field(unsigned int, call )
@@ -620,7 +620,7 @@ TRACE_EVENT(rxrpc_call,
),
TP_fast_assign(
- __entry->call = call->debug_id;
+ __entry->call = call_debug_id;
__entry->op = op;
__entry->usage = usage;
__entry->where = where;
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index c1b1b7dd29245..1f778102ed8d7 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -97,7 +97,7 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
call->flags |= (1 << RXRPC_CALL_IS_SERVICE);
call->state = RXRPC_CALL_SERVER_PREALLOC;
- trace_rxrpc_call(call, rxrpc_call_new_service,
+ trace_rxrpc_call(call->debug_id, rxrpc_call_new_service,
atomic_read(&call->usage),
here, (const void *)user_call_ID);
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 014548c259ceb..7f862a039eddc 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -240,7 +240,8 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
if (p->intr)
__set_bit(RXRPC_CALL_IS_INTR, &call->flags);
call->tx_total_len = p->tx_total_len;
- trace_rxrpc_call(call, rxrpc_call_new_client, atomic_read(&call->usage),
+ trace_rxrpc_call(call->debug_id, rxrpc_call_new_client,
+ atomic_read(&call->usage),
here, (const void *)p->user_call_ID);
/* We need to protect a partially set up call against the user as we
@@ -290,8 +291,8 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
if (ret < 0)
goto error;
- trace_rxrpc_call(call, rxrpc_call_connected, atomic_read(&call->usage),
- here, NULL);
+ trace_rxrpc_call(call->debug_id, rxrpc_call_connected,
+ atomic_read(&call->usage), here, NULL);
rxrpc_start_call_timer(call);
@@ -313,8 +314,8 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
error:
__rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
RX_CALL_DEAD, ret);
- trace_rxrpc_call(call, rxrpc_call_error, atomic_read(&call->usage),
- here, ERR_PTR(ret));
+ trace_rxrpc_call(call->debug_id, rxrpc_call_error,
+ atomic_read(&call->usage), here, ERR_PTR(ret));
rxrpc_release_call(rx, call);
mutex_unlock(&call->user_mutex);
rxrpc_put_call(call, rxrpc_call_put);
@@ -376,7 +377,8 @@ bool rxrpc_queue_call(struct rxrpc_call *call)
if (n == 0)
return false;
if (rxrpc_queue_work(&call->processor))
- trace_rxrpc_call(call, rxrpc_call_queued, n + 1, here, NULL);
+ trace_rxrpc_call(call->debug_id, rxrpc_call_queued, n + 1,
+ here, NULL);
else
rxrpc_put_call(call, rxrpc_call_put_noqueue);
return true;
@@ -391,7 +393,8 @@ bool __rxrpc_queue_call(struct rxrpc_call *call)
int n = atomic_read(&call->usage);
ASSERTCMP(n, >=, 1);
if (rxrpc_queue_work(&call->processor))
- trace_rxrpc_call(call, rxrpc_call_queued_ref, n, here, NULL);
+ trace_rxrpc_call(call->debug_id, rxrpc_call_queued_ref, n,
+ here, NULL);
else
rxrpc_put_call(call, rxrpc_call_put_noqueue);
return true;
@@ -406,7 +409,8 @@ void rxrpc_see_call(struct rxrpc_call *call)
if (call) {
int n = atomic_read(&call->usage);
- trace_rxrpc_call(call, rxrpc_call_seen, n, here, NULL);
+ trace_rxrpc_call(call->debug_id, rxrpc_call_seen, n,
+ here, NULL);
}
}
@@ -418,7 +422,7 @@ void rxrpc_get_call(struct rxrpc_call *call, enum rxrpc_call_trace op)
const void *here = __builtin_return_address(0);
int n = atomic_inc_return(&call->usage);
- trace_rxrpc_call(call, op, n, here, NULL);
+ trace_rxrpc_call(call->debug_id, op, n, here, NULL);
}
/*
@@ -445,7 +449,8 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
_enter("{%d,%d}", call->debug_id, atomic_read(&call->usage));
- trace_rxrpc_call(call, rxrpc_call_release, atomic_read(&call->usage),
+ trace_rxrpc_call(call->debug_id, rxrpc_call_release,
+ atomic_read(&call->usage),
here, (const void *)call->flags);
ASSERTCMP(call->state, ==, RXRPC_CALL_COMPLETE);
@@ -532,12 +537,13 @@ void rxrpc_put_call(struct rxrpc_call *call, enum rxrpc_call_trace op)
{
struct rxrpc_net *rxnet = call->rxnet;
const void *here = __builtin_return_address(0);
+ unsigned int debug_id = call->debug_id;
int n;
ASSERT(call != NULL);
n = atomic_dec_return(&call->usage);
- trace_rxrpc_call(call, op, n, here, NULL);
+ trace_rxrpc_call(debug_id, op, n, here, NULL);
ASSERTCMP(n, >=, 0);
if (n == 0) {
_debug("call %d dead", call->debug_id);
--
2.20.1
next prev parent reply other threads:[~2019-10-26 13:36 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-26 13:14 [PATCH AUTOSEL 5.3 01/99] tools: bpf: Use !building_out_of_srctree to determine srctree Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 05/99] rt2x00: initialize last_reset Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 07/99] mac80211_hwsim: fix incorrect dev_alloc_name failure goto Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 10/99] net: dsa: b53: Do not clear existing mirrored port mask Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 11/99] net: stmmac: selftests: Check if filtering is available before running Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 12/99] net: stmmac: gmac4+: Not all Unicast addresses may be available Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 13/99] net: stmmac: selftests: Fix L2 Hash Filter test Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 16/99] rxrpc: Fix call ref leak Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 17/99] rxrpc: Fix trace-after-put looking at the put peer record Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 18/99] rxrpc: Fix trace-after-put looking at the put connection record Sasha Levin
2019-10-26 13:14 ` Sasha Levin [this message]
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 20/99] rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 21/99] nl80211: fix memory leak in nl80211_get_ftm_responder_stats Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 22/99] cfg80211: fix a bunch of RCU issues in multi-bssid code Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 23/99] mac80211: accept deauth frames in IBSS mode Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 24/99] mac80211: fix scan when operating on DFS channels in ETSI domains Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 25/99] llc: fix sk_buff leak in llc_sap_state_process() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 26/99] llc: fix sk_buff leak in llc_conn_service() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 27/99] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 28/99] llc: fix sk_buff refcounting in llc_conn_state_process() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 29/99] selftests/bpf: Set rp_filter in test_flow_dissector Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 30/99] selftests/bpf: More compatible nc options in test_lwt_ip_encap Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 31/99] net_sched: fix backward compatibility for TCA_KIND Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 32/99] net_sched: fix backward compatibility for TCA_ACT_KIND Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 33/99] NFC: pn533: fix use-after-free and memleaks Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 34/99] ip6erspan: remove the incorrect mtu limit for ip6erspan Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 35/99] iwlwifi: mvm: fix race in sync rx queue notification Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 36/99] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 37/99] iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 38/99] iwlwifi: exclude GEO SAR support for 3168 Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 40/99] net: stmmac: fix length of PTP clock's name string Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 41/99] net: stmmac: fix disabling flexible PPS output Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 42/99] bonding: fix potential NULL deref in bond_update_slave_arr Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 43/99] sctp: add chunks to sk_backlog when the newsk sk_socket is not set Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 46/99] act_mirred: Fix mirred_init_module error handling Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 47/99] net: usb: qmi_wwan: add Telit 0x1050 composition Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 48/99] netns: fix NLM_F_ECHO mechanism for RTM_NEWNSID Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 49/99] netfilter: conntrack: avoid possible false sharing Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 50/99] tun: remove possible false sharing in tun_flow_update() Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 51/99] net: avoid possible false sharing in sk_leave_memory_pressure() Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 52/99] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 53/99] net/smc: fix SMCD link group creation with VLAN id Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 54/99] net/smc: receive returns without data Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 55/99] net/smc: receive pending data after RCV_SHUTDOWN Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 57/99] vhost/test: stop device before reset Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 58/99] net/ibmvnic: Fix EOI when running in XIVE mode Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 59/99] netdevsim: Fix error handling in nsim_fib_init and nsim_fib_exit Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 60/99] ath10k: fix latency issue for QCA988x Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 69/99] net: aquantia: temperature retrieval fix Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 70/99] net: aquantia: do not pass lro session with invalid tcp checksum Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 71/99] net: aquantia: correctly handle macvlan and multicast coexistence Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 78/99] net: i82596: fix dma_alloc_attr for sni_82596 Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 79/99] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 80/99] net: usb: sr9800: fix uninitialized local variable Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 82/99] net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 84/99] usb: hso: obey DMA rules in tiocmget Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 85/99] dpaa2-eth: add irq for the dpmac connect/disconnect event Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 86/99] net: stmmac: fix argument to stmmac_pcs_ctrl_ane() Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 87/99] net: phy: micrel: Discern KSZ8051 and KSZ8795 PHYs Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 88/99] net: phy: micrel: Update KSZ87xx PHY name Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 90/99] net: bcmgenet: don't set phydev->link from MAC Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 91/99] net: phy: bcm7xxx: define soft_reset for 40nm EPHY Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 92/99] net: bcmgenet: reset 40nm EPHY on energy detect Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 93/99] net: usb: lan78xx: Connect PHY before registering MAC Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 98/99] net: hns3: fix mis-counting IRQ vector numbers issue Sasha Levin
2019-10-26 13:16 ` [PATCH AUTOSEL 5.3 99/99] net: aquantia: add an error handling in aq_nic_set_multicast_list Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191026131600.2507-19-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dhowells@redhat.com \
--cc=linux-afs@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).