Chen Lin 128c06a34c ring-buffer: Do not swap cpu_buffer during resize process ... [ Upstream commit 8a96c0288d0737ad77882024974c075345c72011 ] When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. Continuing to run in the wrong state will result in oops. This issue can be easily reproduced using the following two scripts: /tmp # cat test1.sh //#! /bin/sh for i in `seq 0 100000` do echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 done /tmp # cat test2.sh //#! /bin/sh for i in `seq 0 100000` do echo irqsoff > /sys/kernel/debug/tracing/current_tracer sleep 1 echo nop > /sys/kernel/debug/tracing/current_tracer sleep 1 done /tmp # ./test1.sh & /tmp # ./test2.sh & A typical oops log is as follows, sometimes with other different oops logs. [ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 [ 231.713375] Modules linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750] Hardware name: linux,dummy-virt (DT) [ 231.718152] Workqueue: events update_pages_handler [ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 231.721171] pc : rb_update_pages+0x378/0x3f8 [ 231.722212] lr : rb_update_pages+0x25c/0x3f8 [ 231.723248] sp : ffff800082b9bd50 [ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0 [ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a [ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000 [ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510 [ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002 [ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558 [ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001 [ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000 [ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208 [ 231.744196] Call trace: [ 231.744892] rb_update_pages+0x378/0x3f8 [ 231.745893] update_pages_handler+0x1c/0x38 [ 231.746893] process_one_work+0x1f0/0x468 [ 231.747852] worker_thread+0x54/0x410 [ 231.748737] kthread+0x124/0x138 [ 231.749549] ret_from_fork+0x10/0x20 [ 231.750434] ---[ end trace 0000000000000000 ]--- [ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 233.721696] Mem abort info: [ 233.721935] ESR = 0x0000000096000004 [ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits [ 233.722596] SET = 0, FnV = 0 [ 233.722805] EA = 0, S1PTW = 0 [ 233.723026] FSC = 0x04: level 0 translation fault [ 233.723458] Data abort info: [ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000 [ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 233.726720] Modules linked in: [ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 233.727777] Hardware name: linux,dummy-virt (DT) [ 233.728225] Workqueue: events update_pages_handler [ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 233.729054] pc : rb_update_pages+0x1a8/0x3f8 [ 233.729334] lr : rb_update_pages+0x154/0x3f8 [ 233.729592] sp : ffff800082b9bd50 [ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [ 233.730220] x26: 0000000000000000 x25: ffff800082a8b840 x24: ffff0000c0102418 [ 233.730653] x23: 0000000000000000 x22: fffffc000304c880 x21: 0000000000000003 [ 233.731105] x20: 00000000000001f4 x19: ffff0000c0102400 x18: ffff800082fcbc58 [ 233.731727] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000001 [ 233.732282] x14: ffff8000825fe0c8 x13: 0000000000000001 x12: 0000000000000000 [ 233.732709] x11: ffff8000826998a8 x10: 0000000000000ae0 x9 : ffff8000801b760c [ 233.733148] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffff0000c03298c0 [ 233.733553] x5 : 0000000000000002 x4 : 0000000000000000 x3 : 0000000000000000 [ 233.733972] x2 : ffff0000c3a0b600 x1 : 0000000000000000 x0 : 0000000000000000 [ 233.734418] Call trace: [ 233.734593] rb_update_pages+0x1a8/0x3f8 [ 233.734853] update_pages_handler+0x1c/0x38 [ 233.735148] process_one_work+0x1f0/0x468 [ 233.735525] worker_thread+0x54/0x410 [ 233.735852] kthread+0x124/0x138 [ 233.736064] ret_from_fork+0x10/0x20 [ 233.736387] Code: 92400000 910006b5 aa000021 aa0303f7 (f9400060) [ 233.736959] ---[ end trace 0000000000000000 ]--- After analysis, the seq of the error is as follows [1-5]: int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, int cpu_id) { for_each_buffer_cpu(buffer, cpu) { cpu_buffer = buffer->buffers[cpu]; //1. get cpu_buffer, aka cpu_buffer(A) ... ... schedule_work_on(cpu, &cpu_buffer->update_pages_work); //2. 'update_pages_work' is queue on 'cpu', cpu_buffer(A) is passed to // update_pages_handler, do the update process, set 'update_done' in // complete(&cpu_buffer->update_done) and to wakeup resize process. //----> //3. Just at this moment, ring_buffer_swap_cpu is triggered, //cpu_buffer(A) be swaped to cpu_buffer(B), the max_buffer. //ring_buffer_swap_cpu is called as the 'Call trace' below. Call trace: dump_backtrace+0x0/0x2f8 show_stack+0x18/0x28 dump_stack+0x12c/0x188 ring_buffer_swap_cpu+0x2f8/0x328 update_max_tr_single+0x180/0x210 check_critical_timing+0x2b4/0x2c8 tracer_hardirqs_on+0x1c0/0x200 trace_hardirqs_on+0xec/0x378 el0_svc_common+0x64/0x260 do_el0_svc+0x90/0xf8 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb8 el0_sync+0x180/0x1c0 //<---- /* wait for all the updates to complete */ for_each_buffer_cpu(buffer, cpu) { cpu_buffer = buffer->buffers[cpu]; //4. get cpu_buffer, cpu_buffer(B) is used in the following process, //the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong. //for example, cpu_buffer(A)->update_done will leave be set 1, and will //not 'wait_for_completion' at the next resize round. if (!cpu_buffer->nr_pages_to_update) continue; if (cpu_online(cpu)) wait_for_completion(&cpu_buffer->update_done); cpu_buffer->nr_pages_to_update = 0; } ... } //5. the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong, //Continuing to run in the wrong state, then oops occurs. Link: https://lore.kernel.org/linux-trace-kernel/202307191558478409990@zte.com.cn Signed-off-by: Chen Lin <chen.lin5@zte.com.cn> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-08-23 17:52:27 +02:00
..
bpf	bpf, cpumap: Make sure kthread is running before map update returns	2023-08-11 12:08:23 +02:00
cgroup	sched/psi: use kernfs polling functions for PSI trigger polling	2023-07-27 08:50:38 +02:00
configs	Kbuild: add Rust support	2022-09-28 09:02:20 +02:00
debug	mm: remove vmacache	2022-09-26 19:46:18 -07:00
dma	dma-remap: use kvmalloc_array/kvfree for larger dma memory remap	2023-08-23 17:52:21 +02:00
entry	entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up	2023-03-30 12:49:13 +02:00
events	perf: Fix function pointer case	2023-08-11 12:08:09 +02:00
futex	futex: Fix futex_waitv() hrtimer debug object leak on kcalloc error	2023-01-04 11:28:58 +01:00
gcov	gcov: add support for checksum field	2022-12-31 13:33:11 +01:00
irq	x86/pci/xen: populate MSI sysfs entries	2023-05-30 14:03:22 +01:00
kcsan	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures	2023-07-19 16:21:37 +02:00
livepatch	Livepatching changes for 6.1	2022-10-10 11:36:19 -07:00
locking	locking/rtmutex: Fix task->pi_waiters integrity	2023-08-03 10:24:14 +02:00
module	module: Don't wait for GOING modules	2023-02-01 08:34:37 +01:00
power	PM: QoS: Restore support for default value on frequency QoS	2023-07-23 13:49:45 +02:00
printk	kernel/printk/index.c: fix memory leak with using debugfs_lookup()	2023-03-11 13:55:32 +01:00
rcu	rcu: Mark additional concurrent load from ->cpu_no_qs.b.exp	2023-07-27 08:50:33 +02:00
sched	sched/psi: use kernfs polling functions for PSI trigger polling	2023-07-27 08:50:38 +02:00
time	tick/rcu: Fix bogus ratelimit condition	2023-07-19 16:20:59 +02:00
trace	ring-buffer: Do not swap cpu_buffer during resize process	2023-08-23 17:52:27 +02:00
.gitignore
acct.c	acct: fix potential integer overflow in encode_comp_t()	2022-12-31 13:32:58 +01:00
async.c
audit.c	audit: use time_after to compare time	2022-08-29 19:47:03 -04:00
audit.h	audit: remove selinux_audit_rule_update() declaration	2022-09-07 11:30:15 -04:00
audit_fsnotify.c	audit: fix potential double free on error path from fsnotify_add_inode_mark	2022-08-22 18:50:06 -04:00
audit_tree.c
audit_watch.c	audit_init_parent(): constify path	2022-09-01 17:39:30 -04:00
auditfilter.c
auditsc.c	audit/stable-6.1 PR 20221003	2022-10-04 11:05:43 -07:00
backtracetest.c
bounds.c	mm: multi-gen LRU: minimal implementation	2022-09-26 19:46:09 -07:00
capability.c
cfi.c	cfi: Switch to -fsanitize=kcfi	2022-09-26 10:13:13 -07:00
compat.c	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized	2023-04-06 12:10:40 +02:00
configs.c
context_tracking.c	context_tracking: Fix noinstr vs KASAN	2023-03-10 09:33:45 +01:00
cpu.c	cpu/hotplug: Do not bail-out in DYING/STARTING sections	2022-12-31 13:31:59 +01:00
cpu_pm.c	context_tracking: Take IRQ eqs entrypoints over RCU	2022-07-05 13:32:59 -07:00
crash_core.c	vmcoreinfo: add kallsyms_num_syms symbol	2022-08-28 14:02:44 -07:00
crash_dump.c
cred.c
delayacct.c	delayacct: support re-entrance detection of thrashing accounting	2022-09-26 19:46:07 -07:00
dma.c
exec_domain.c
exit.c	exit: Detect and fix irq disabled state in oops	2023-03-10 09:33:45 +01:00
extable.c	context_tracking: Take NMI eqs entrypoints over RCU	2022-07-05 13:32:59 -07:00
fail_function.c	kernel/fail_function: fix memory leak with using debugfs_lookup()	2023-03-11 13:55:39 +01:00
fork.c	mm: Move mm_cachep initialization to mm_init()	2023-08-08 20:03:49 +02:00
freezer.c	freezer,sched: Rewrite core freezer logic	2022-09-07 21:53:50 +02:00
gen_kheaders.sh	kbuild: build init/built-in.a just once	2022-09-29 04:40:15 +09:00
groups.c	security: Add LSM hook to setgroups() syscall	2022-07-15 18:21:49 +00:00
hung_task.c	sched: Fix more TASK_state comparisons	2022-09-30 16:50:39 +02:00
iomem.c
irq_work.c
jump_label.c	jump_label: make initial NOP patching the special case	2022-06-24 09:48:55 +02:00
kallsyms.c	kallsyms: strip LTO-only suffixes from promoted global functions	2023-07-27 08:50:39 +02:00
kallsyms_internal.h	kallsyms: Improve the performance of kallsyms_lookup_name()	2023-07-27 08:50:39 +02:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: kmsan: unpoison area->list in kcov_remote_area_put()	2022-10-03 14:03:23 -07:00
kexec.c	panic, kexec: make __crash_kexec() NMI safe	2022-09-11 21:55:06 -07:00
kexec_core.c	kexec: fix a memory leak in crash_shrink_memory()	2023-07-19 16:21:08 +02:00
kexec_elf.c
kexec_file.c	kexec: support purgatories with .text.hot sections	2023-06-21 16:00:55 +02:00
kexec_internal.h	panic, kexec: make __crash_kexec() NMI safe	2022-09-11 21:55:06 -07:00
kheaders.c	kheaders: Use array declaration instead of char	2023-05-11 23:03:02 +09:00
kmod.c
kprobes.c	kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list	2023-03-10 09:34:27 +01:00
ksysfs.c	kexec: turn all kexec_mutex acquisitions into trylocks	2022-09-11 21:55:06 -07:00
kthread.c	signal: break out of wait loops on kthread_stop()	2022-10-09 16:01:59 -07:00
latencytop.c	latencytop: use the last element of latency_record of system	2022-09-11 21:55:12 -07:00
Makefile	cfi: Fix CFI failure with KASAN	2022-12-31 13:33:08 +01:00
module_signature.c
notifier.c
nsproxy.c	Revert "fs/exec: allow to unshare a time namespace on vfork+exec"	2022-09-13 10:38:43 -07:00
padata.c	padata: Fix list iterator in padata_do_serial()	2022-12-31 13:32:34 +01:00
panic.c	panic: fix the panic_print NMI backtrace setting	2023-03-10 09:34:25 +01:00
params.c
pid.c	gfs2: Add glockfd debugfs file	2022-06-29 13:07:16 +02:00
pid_namespace.c	rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()	2023-03-10 09:32:52 +01:00
profile.c	kernel/profile.c: simplify duplicated code in profile_setup()	2022-09-11 21:55:12 -07:00
ptrace.c	freezer,sched: Rewrite core freezer logic	2022-09-07 21:53:50 +02:00
range.c
reboot.c	kernel/reboot: Add SYS_OFF_MODE_RESTART_PREPARE mode	2022-10-04 15:59:36 +02:00
regset.c
relay.c	relayfs: fix out-of-bounds access in relay_file_read	2023-05-11 23:03:03 +09:00
resource.c	dax/kmem: Fix leak of memory-hotplug resources	2023-03-10 09:34:25 +01:00
resource_kunit.c
rseq.c	rseq: Use pr_warn_once() when deprecated/unknown ABI flags are encountered	2022-11-14 09:58:32 +01:00
scftorture.c
scs.c
seccomp.c
signal.c	mm: suppress mm fault logging if fatal signal already pending	2023-08-03 10:24:01 +02:00
smp.c	bitmap patches for v6.1-rc1	2022-10-10 12:49:34 -07:00
smpboot.c	smpboot: use atomic_try_cmpxchg in cpu_wait_death and cpu_report_death	2022-09-11 21:55:10 -07:00
smpboot.h
softirq.c	context_tracking: Take IRQ eqs entrypoints over RCU	2022-07-05 13:32:59 -07:00
stackleak.c
stacktrace.c
static_call.c
static_call_inline.c
stop_machine.c	Scheduler changes in this cycle were:	2022-05-24 11:11:13 -07:00
sys.c	kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()	2023-04-26 14:28:39 +02:00
sys_ni.c	kernel/sys_ni: add compat entry for fadvise64_64	2022-08-20 15:17:45 -07:00
sysctl-test.c	kernel/sysctl-test: use SYSCTL_{ZERO/ONE_HUNDRED} instead of i_{zero/one_hundred}	2022-09-08 16:56:45 -07:00
sysctl.c	proc: proc_skip_spaces() shouldn't think it is working on C strings	2022-12-05 12:09:06 -08:00
task_work.c	task_work: use try_cmpxchg in task_work_add, task_work_cancel_match and task_work_run	2022-09-11 21:55:10 -07:00
taskstats.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
torture.c	torture: Fix hang during kthread shutdown phase	2023-03-10 09:34:07 +01:00
tracepoint.c	tracepoint: Optimize the critical region of mutex_lock in tracepoint_module_coming()	2022-09-26 13:01:18 -04:00
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c	freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL	2023-02-22 12:59:50 +01:00
up.c
user-return-notifier.c
user.c
user_namespace.c	ucounts: Split rlimit and ucount values and max values	2022-10-09 16:24:05 -07:00
usermode_driver.c
utsname.c
utsname_sysctl.c	kernel/utsname_sysctl.c: Fix hostname polling	2022-10-23 12:01:01 -07:00
watch_queue.c	watch_queue: prevent dangling pipe pointer	2023-07-19 16:22:10 +02:00
watchdog.c	powerpc updates for 6.0	2022-08-06 16:38:17 -07:00
watchdog_hld.c	watchdog/perf: more properly prevent false positives with turbo modes	2023-07-19 16:21:08 +02:00
workqueue.c	workqueue: clean up WORK_* constant types, clarify masking	2023-07-23 13:49:19 +02:00
workqueue_internal.h