Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rust: remove guard for rust-bindgen bug #1

Closed
wants to merge 1 commit into from

Conversation

TheSven73
Copy link
Owner

The bug which this guard protects against
(rust-lang/rust-bindgen#1671)
was fixed upstream as of rust-bindgen v0.53:
rust-lang/rust-bindgen#1688
d650823839f7 ("Remove size_t to usize conversion")

The current recommended rust-bindgen version for building
the Linux kernel is v0.56, so the guard can be safely
dropped.

Signed-off-by: Sven Van Asbroeck [email protected]

The bug which this guard protects against
(rust-lang/rust-bindgen#1671)
was fixed upstream as of rust-bindgen v0.53:
rust-lang/rust-bindgen#1688
d650823839f7 ("Remove size_t to usize conversion")

The current recommended rust-bindgen version for building
the Linux kernel is v0.56, so the guard can be safely
dropped.

Signed-off-by: Sven Van Asbroeck <[email protected]>
@TheSven73 TheSven73 closed this Apr 13, 2021
@TheSven73 TheSven73 deleted the rust-for-linux-cleanup-guard branch April 13, 2021 15:33
@TheSven73 TheSven73 restored the rust-for-linux-cleanup-guard branch April 13, 2021 15:35
@TheSven73 TheSven73 deleted the rust-for-linux-cleanup-guard branch April 13, 2021 15:35
@TheSven73 TheSven73 restored the rust-for-linux-cleanup-guard branch April 13, 2021 15:36
@TheSven73 TheSven73 reopened this Apr 13, 2021
@TheSven73 TheSven73 closed this Apr 14, 2021
@TheSven73 TheSven73 deleted the rust-for-linux-cleanup-guard branch April 14, 2021 23:52
TheSven73 pushed a commit that referenced this pull request Apr 15, 2021
In 32-bit arm debug mode, Rust stack probing doesn't appear to
work. Disable it as a temporary measure.

Error message on QEMU virt/cortex-a7:
[   40.708784] rust_stack_probing: Rust stack probing sample (init)
[   40.722177] ------------[ cut here ]------------
[   40.722308] 8<--- cut here ---
[   40.722319] Unable to handle kernel paging request at virtual address aaaaad02
[   40.722326] pgd = (ptrval)
[   40.722344] [aaaaad02] *pgd=00000000
[   40.722367] Internal error: Oops: 5 [#1] SMP ARM
[   40.722373] Modules linked in: rust_stack_probing(+) [last unloaded: rust_miscdev]
[   40.722397] CPU: 1 PID: 39 Comm: kworker/1:2 Tainted: G        W         5.12.0-rc4-gc5e3c2361cdd-dirty #1
[   40.722404] Hardware name: Generic DT based system
[   40.722409] PC is at do_page_fault+0x80/0x3bc
[   40.722415] LR is at do_translation_fault+0x30/0xe8
[   40.722420] pc : [<c0553f78>]    lr : [<c0553e40>]    psr: 60000193
[   40.722426] sp : c403a030  ip : 00000051  fp : c0a1280c
[   40.722432] r10: aaaaad02  r9 : c403a000  r8 : 00000005
[   40.722438] r7 : 00000005  r6 : c403a0a8  r5 : 00000005  r4 : c403a0a8
[   40.722445] r3 : c403a0a8  r2 : c403a0a8  r1 : c403a00c  r0 : aaaaaaaa
[   40.722451] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   40.722457] Control: 10c5387d  Table: 4401806a  DAC: 00000051
[   40.722474] Process kworker/1:2 (pid: 39, stack limit = 0x(ptrval))
[   40.722480] Stack: (0xc403a030 to 0xc403a000)
[   40.722486] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722492] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722499] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722504] Exception stack(0xc403a0a8 to 0xc403a0f0)
[   40.722510] a0a0:                   aaaaaaaa c403a00c c403a170 c403a170 c403a170 00000005
[   40.722517] a0c0: c403a170 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a0f8
[   40.722523] a0e0: c0553e40 c0553f78 60000193 ffffffff
[   40.722529] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722535] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722541] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722548] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722553] Exception stack(0xc403a170 to 0xc403a1b8)
[   40.722559] a160:                                     aaaaaaaa c403a00c c403a238 c403a238
[   40.722565] a180: c403a238 00000005 c403a238 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722572] a1a0: 00000051 c403a1c0 c0553e40 c0553f78 60000193 ffffffff
[   40.722578] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722584] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722590] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722597] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722602] Exception stack(0xc403a238 to 0xc403a280)
[   40.722608] a220:                                                       aaaaaaaa c403a00c
[   40.722615] a240: c403a300 c403a300 c403a300 00000005 c403a300 00000005 00000005 c403a000
[   40.722621] a260: aaaaad02 c0a1280c 00000051 c403a288 c0553e40 c0553f78 60000193 ffffffff
[   40.722628] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722634] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722640] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722646] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722652] Exception stack(0xc403a300 to 0xc403a348)
[   40.722658] a300: aaaaaaaa c403a00c c403a3c c403a3c c403a3c 00000005 c403a3c 00000005
[   40.722665] a320: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a350 c0553e40 c0553f78
[   40.722671] a340: 60000193 ffffffff
[   40.722677] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722683] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722689] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722696] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722702] Exception stack(0xc403a3c8 to 0xc403a410)
[   40.722708] a3c0:                   aaaaaaaa c403a00c c403a490 c403a490 c403a490 00000005
[   40.722714] a3e0: c403a490 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a418
[   40.722720] a400: c0553e40 c0553f78 60000193 ffffffff
[   40.722726] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722732] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722738] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722745] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722750] Exception stack(0xc403a490 to 0xc403a4d8)
[   40.722756] a480:                                     aaaaaaaa c403a00c c403a558 c403a558
[   40.722762] a4a0: c403a558 00000005 c403a558 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722769] a4c0: 00000051 c403a4e0 c0553e40 c0553f78 60000193 ffffffff
[   40.722775] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722781] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722788] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722794] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722800] Exception stack(0xc403a558 to 0xc403a5a0)
[   40.722806] a540:                                                       aaaaaaaa c403a00c
[   40.722812] a560: c403a620 c403a620 c403a620 00000005 c403a620 00000005 00000005 c403a000
[   40.722818] a580: aaaaad02 c0a1280c 00000051 c403a5a8 c0553e40 c0553f78 60000193 ffffffff
[   40.722825] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722831] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722837] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722844] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722850] Exception stack(0xc403a620 to 0xc403a668)
[   40.722855] a620: aaaaaaaa c403a00c c403a6e8 c403a6e8 c403a6e8 00000005 c403a6e8 00000005
[   40.722862] a640: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a670 c0553e40 c0553f78
[   40.722868] a660: 60000193 ffffffff
[   40.722873] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722879] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722886] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722892] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722898] Exception stack(0xc403a6e8 to 0xc403a730)
[   40.722903] a6e0:                   aaaaaaaa c403a00c c403a7b0 c403a7b0 c403a7b0 00000005
[   40.722909] a700: c403a7b0 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a738
[   40.722915] a720: c0553e40 c0553f78 60000193 ffffffff
[   40.722920] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722927] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722950] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722957] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722963] Exception stack(0xc403a7b0 to 0xc403a7f8)
[   40.722970] a7a0:                                     aaaaaaaa c403a00c c403a878 c403a878
[   40.722976] a7c0: c403a878 00000005 c403a878 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722983] a7e0: 00000051 c403a800 c0553e40 c0553f78 60000193 ffffffff
[   40.722989] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722996] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723003] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723010] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723016] Exception stack(0xc403a878 to 0xc403a8c0)
[   40.723022] a860:                                                       aaaaaaaa c403a00c
[   40.723029] a880: c403a940 c403a940 c403a940 00000005 c403a940 00000005 00000005 c403a000
[   40.723035] a8a0: aaaaad02 c0a1280c 00000051 c403a8c8 c0553e40 c0553f78 60000193 ffffffff
[   40.723042] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.723048] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723055] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723062] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723068] Exception stack(0xc403a940 to 0xc403a988)
[   40.723074] a940: aaaaaaaa c403a00c c403aa08 c403aa08 c403aa08 00000005 c403aa08 00000005
[   40.723081] a960: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a990 c0553e40 c0553f78
[   40.723087] a980: 60000193 ffffffff
[   40.723093] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.723099] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723106] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723113] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723119] Exception stack(0xc403aa08 to 0xc403aa50)
[   40.723125] aa00:                   aaaaaaaa c403a00c c403aad0 c403aad0 c403aad0 00000005
[   40.723144] aa20: c403aad0 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c4
[   40.723195] Lost 157 message(s)!
[   40.723449] CPU0: stopping
[   40.804702] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G      D W         5.12.0-rc4-gc5e3c2361cdd-dirty #1
[   40.805864] Hardware name: Generic DT based system
[   40.806561] [<c0111a74>] (unwind_backtrace) from [<c010d140>] (show_stack+0x10/0x14)
[   40.808075] [<c010d140>] (show_stack) from [<c0452d28>] (dump_stack+0xbc/0x110)
[   40.808935] [<c0452d28>] (dump_stack) from [<c0110978>] (ipi_cpu_stop+0x6c/0x78)
[   40.809717] [<c0110978>] (ipi_cpu_stop) from [<c01106b4>] (ipi_handler+0x0/0x20)
[   40.810485] [<c01106b4>] (ipi_handler) from [<00000014>] (0x14)

Signed-off-by: Sven Van Asbroeck <[email protected]>
TheSven73 pushed a commit that referenced this pull request Apr 15, 2021
In 32-bit arm debug mode, Rust stack probing doesn't appear to
work. Disable it as a temporary measure.

Error message on QEMU virt/cortex-a7:
[   40.708784] rust_stack_probing: Rust stack probing sample (init)
[   40.722177] ------------[ cut here ]------------
[   40.722308] 8<--- cut here ---
[   40.722319] Unable to handle kernel paging request at virtual address aaaaad02
[   40.722326] pgd = (ptrval)
[   40.722344] [aaaaad02] *pgd=00000000
[   40.722367] Internal error: Oops: 5 [#1] SMP ARM
[   40.722373] Modules linked in: rust_stack_probing(+) [last unloaded: rust_miscdev]
[   40.722397] CPU: 1 PID: 39 Comm: kworker/1:2 Tainted: G        W         5.12.0-rc4-gc5e3c2361cdd-dirty #1
[   40.722404] Hardware name: Generic DT based system
[   40.722409] PC is at do_page_fault+0x80/0x3bc
[   40.722415] LR is at do_translation_fault+0x30/0xe8
[   40.722420] pc : [<c0553f78>]    lr : [<c0553e40>]    psr: 60000193
[   40.722426] sp : c403a030  ip : 00000051  fp : c0a1280c
[   40.722432] r10: aaaaad02  r9 : c403a000  r8 : 00000005
[   40.722438] r7 : 00000005  r6 : c403a0a8  r5 : 00000005  r4 : c403a0a8
[   40.722445] r3 : c403a0a8  r2 : c403a0a8  r1 : c403a00c  r0 : aaaaaaaa
[   40.722451] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   40.722457] Control: 10c5387d  Table: 4401806a  DAC: 00000051
[   40.722474] Process kworker/1:2 (pid: 39, stack limit = 0x(ptrval))
[   40.722480] Stack: (0xc403a030 to 0xc403a000)
[   40.722486] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722492] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722499] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722504] Exception stack(0xc403a0a8 to 0xc403a0f0)
[   40.722510] a0a0:                   aaaaaaaa c403a00c c403a170 c403a170 c403a170 00000005
[   40.722517] a0c0: c403a170 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a0f8
[   40.722523] a0e0: c0553e40 c0553f78 60000193 ffffffff
[   40.722529] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722535] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722541] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722548] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722553] Exception stack(0xc403a170 to 0xc403a1b8)
[   40.722559] a160:                                     aaaaaaaa c403a00c c403a238 c403a238
[   40.722565] a180: c403a238 00000005 c403a238 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722572] a1a0: 00000051 c403a1c0 c0553e40 c0553f78 60000193 ffffffff
[   40.722578] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722584] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722590] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722597] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722602] Exception stack(0xc403a238 to 0xc403a280)
[   40.722608] a220:                                                       aaaaaaaa c403a00c
[   40.722615] a240: c403a300 c403a300 c403a300 00000005 c403a300 00000005 00000005 c403a000
[   40.722621] a260: aaaaad02 c0a1280c 00000051 c403a288 c0553e40 c0553f78 60000193 ffffffff
[   40.722628] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722634] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722640] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722646] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722652] Exception stack(0xc403a300 to 0xc403a348)
[   40.722658] a300: aaaaaaaa c403a00c c403a3c c403a3c c403a3c 00000005 c403a3c 00000005
[   40.722665] a320: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a350 c0553e40 c0553f78
[   40.722671] a340: 60000193 ffffffff
[   40.722677] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722683] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722689] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722696] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722702] Exception stack(0xc403a3c8 to 0xc403a410)
[   40.722708] a3c0:                   aaaaaaaa c403a00c c403a490 c403a490 c403a490 00000005
[   40.722714] a3e0: c403a490 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a418
[   40.722720] a400: c0553e40 c0553f78 60000193 ffffffff
[   40.722726] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722732] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722738] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722745] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722750] Exception stack(0xc403a490 to 0xc403a4d8)
[   40.722756] a480:                                     aaaaaaaa c403a00c c403a558 c403a558
[   40.722762] a4a0: c403a558 00000005 c403a558 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722769] a4c0: 00000051 c403a4e0 c0553e40 c0553f78 60000193 ffffffff
[   40.722775] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722781] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722788] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722794] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722800] Exception stack(0xc403a558 to 0xc403a5a0)
[   40.722806] a540:                                                       aaaaaaaa c403a00c
[   40.722812] a560: c403a620 c403a620 c403a620 00000005 c403a620 00000005 00000005 c403a000
[   40.722818] a580: aaaaad02 c0a1280c 00000051 c403a5a8 c0553e40 c0553f78 60000193 ffffffff
[   40.722825] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722831] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722837] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722844] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722850] Exception stack(0xc403a620 to 0xc403a668)
[   40.722855] a620: aaaaaaaa c403a00c c403a6e8 c403a6e8 c403a6e8 00000005 c403a6e8 00000005
[   40.722862] a640: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a670 c0553e40 c0553f78
[   40.722868] a660: 60000193 ffffffff
[   40.722873] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722879] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722886] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722892] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722898] Exception stack(0xc403a6e8 to 0xc403a730)
[   40.722903] a6e0:                   aaaaaaaa c403a00c c403a7b0 c403a7b0 c403a7b0 00000005
[   40.722909] a700: c403a7b0 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a738
[   40.722915] a720: c0553e40 c0553f78 60000193 ffffffff
[   40.722920] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722927] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722950] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722957] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722963] Exception stack(0xc403a7b0 to 0xc403a7f8)
[   40.722970] a7a0:                                     aaaaaaaa c403a00c c403a878 c403a878
[   40.722976] a7c0: c403a878 00000005 c403a878 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722983] a7e0: 00000051 c403a800 c0553e40 c0553f78 60000193 ffffffff
[   40.722989] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722996] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723003] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723010] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723016] Exception stack(0xc403a878 to 0xc403a8c0)
[   40.723022] a860:                                                       aaaaaaaa c403a00c
[   40.723029] a880: c403a940 c403a940 c403a940 00000005 c403a940 00000005 00000005 c403a000
[   40.723035] a8a0: aaaaad02 c0a1280c 00000051 c403a8c8 c0553e40 c0553f78 60000193 ffffffff
[   40.723042] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.723048] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723055] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723062] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723068] Exception stack(0xc403a940 to 0xc403a988)
[   40.723074] a940: aaaaaaaa c403a00c c403aa08 c403aa08 c403aa08 00000005 c403aa08 00000005
[   40.723081] a960: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a990 c0553e40 c0553f78
[   40.723087] a980: 60000193 ffffffff
[   40.723093] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.723099] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723106] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723113] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723119] Exception stack(0xc403aa08 to 0xc403aa50)
[   40.723125] aa00:                   aaaaaaaa c403a00c c403aad0 c403aad0 c403aad0 00000005
[   40.723144] aa20: c403aad0 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c4
[   40.723195] Lost 157 message(s)!
[   40.723449] CPU0: stopping
[   40.804702] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G      D W         5.12.0-rc4-gc5e3c2361cdd-dirty #1
[   40.805864] Hardware name: Generic DT based system
[   40.806561] [<c0111a74>] (unwind_backtrace) from [<c010d140>] (show_stack+0x10/0x14)
[   40.808075] [<c010d140>] (show_stack) from [<c0452d28>] (dump_stack+0xbc/0x110)
[   40.808935] [<c0452d28>] (dump_stack) from [<c0110978>] (ipi_cpu_stop+0x6c/0x78)
[   40.809717] [<c0110978>] (ipi_cpu_stop) from [<c01106b4>] (ipi_handler+0x0/0x20)
[   40.810485] [<c01106b4>] (ipi_handler) from [<00000014>] (0x14)

Signed-off-by: Sven Van Asbroeck <[email protected]>
TheSven73 pushed a commit that referenced this pull request Apr 15, 2021
In 32-bit arm debug mode, Rust stack probing doesn't appear to
work. Disable it as a temporary measure.

Error message on QEMU virt/cortex-a7:
[   40.708784] rust_stack_probing: Rust stack probing sample (init)
[   40.722177] ------------[ cut here ]------------
[   40.722308] 8<--- cut here ---
[   40.722319] Unable to handle kernel paging request at virtual address aaaaad02
[   40.722326] pgd = (ptrval)
[   40.722344] [aaaaad02] *pgd=00000000
[   40.722367] Internal error: Oops: 5 [#1] SMP ARM
[   40.722373] Modules linked in: rust_stack_probing(+) [last unloaded: rust_miscdev]
[   40.722397] CPU: 1 PID: 39 Comm: kworker/1:2 Tainted: G        W         5.12.0-rc4-gc5e3c2361cdd-dirty #1
[   40.722404] Hardware name: Generic DT based system
[   40.722409] PC is at do_page_fault+0x80/0x3bc
[   40.722415] LR is at do_translation_fault+0x30/0xe8
[   40.722420] pc : [<c0553f78>]    lr : [<c0553e40>]    psr: 60000193
[   40.722426] sp : c403a030  ip : 00000051  fp : c0a1280c
[   40.722432] r10: aaaaad02  r9 : c403a000  r8 : 00000005
[   40.722438] r7 : 00000005  r6 : c403a0a8  r5 : 00000005  r4 : c403a0a8
[   40.722445] r3 : c403a0a8  r2 : c403a0a8  r1 : c403a00c  r0 : aaaaaaaa
[   40.722451] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   40.722457] Control: 10c5387d  Table: 4401806a  DAC: 00000051
[   40.722474] Process kworker/1:2 (pid: 39, stack limit = 0x(ptrval))
[   40.722480] Stack: (0xc403a030 to 0xc403a000)
[   40.722486] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722492] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722499] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722504] Exception stack(0xc403a0a8 to 0xc403a0f0)
[   40.722510] a0a0:                   aaaaaaaa c403a00c c403a170 c403a170 c403a170 00000005
[   40.722517] a0c0: c403a170 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a0f8
[   40.722523] a0e0: c0553e40 c0553f78 60000193 ffffffff
[   40.722529] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722535] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722541] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722548] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722553] Exception stack(0xc403a170 to 0xc403a1b8)
[   40.722559] a160:                                     aaaaaaaa c403a00c c403a238 c403a238
[   40.722565] a180: c403a238 00000005 c403a238 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722572] a1a0: 00000051 c403a1c0 c0553e40 c0553f78 60000193 ffffffff
[   40.722578] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722584] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722590] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722597] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722602] Exception stack(0xc403a238 to 0xc403a280)
[   40.722608] a220:                                                       aaaaaaaa c403a00c
[   40.722615] a240: c403a300 c403a300 c403a300 00000005 c403a300 00000005 00000005 c403a000
[   40.722621] a260: aaaaad02 c0a1280c 00000051 c403a288 c0553e40 c0553f78 60000193 ffffffff
[   40.722628] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722634] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722640] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722646] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722652] Exception stack(0xc403a300 to 0xc403a348)
[   40.722658] a300: aaaaaaaa c403a00c c403a3c c403a3c c403a3c 00000005 c403a3c 00000005
[   40.722665] a320: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a350 c0553e40 c0553f78
[   40.722671] a340: 60000193 ffffffff
[   40.722677] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722683] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722689] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722696] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722702] Exception stack(0xc403a3c8 to 0xc403a410)
[   40.722708] a3c0:                   aaaaaaaa c403a00c c403a490 c403a490 c403a490 00000005
[   40.722714] a3e0: c403a490 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a418
[   40.722720] a400: c0553e40 c0553f78 60000193 ffffffff
[   40.722726] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722732] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722738] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722745] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722750] Exception stack(0xc403a490 to 0xc403a4d8)
[   40.722756] a480:                                     aaaaaaaa c403a00c c403a558 c403a558
[   40.722762] a4a0: c403a558 00000005 c403a558 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722769] a4c0: 00000051 c403a4e0 c0553e40 c0553f78 60000193 ffffffff
[   40.722775] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722781] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722788] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722794] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722800] Exception stack(0xc403a558 to 0xc403a5a0)
[   40.722806] a540:                                                       aaaaaaaa c403a00c
[   40.722812] a560: c403a620 c403a620 c403a620 00000005 c403a620 00000005 00000005 c403a000
[   40.722818] a580: aaaaad02 c0a1280c 00000051 c403a5a8 c0553e40 c0553f78 60000193 ffffffff
[   40.722825] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722831] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722837] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722844] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722850] Exception stack(0xc403a620 to 0xc403a668)
[   40.722855] a620: aaaaaaaa c403a00c c403a6e8 c403a6e8 c403a6e8 00000005 c403a6e8 00000005
[   40.722862] a640: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a670 c0553e40 c0553f78
[   40.722868] a660: 60000193 ffffffff
[   40.722873] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722879] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722886] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722892] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722898] Exception stack(0xc403a6e8 to 0xc403a730)
[   40.722903] a6e0:                   aaaaaaaa c403a00c c403a7b0 c403a7b0 c403a7b0 00000005
[   40.722909] a700: c403a7b0 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a738
[   40.722915] a720: c0553e40 c0553f78 60000193 ffffffff
[   40.722920] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722927] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.722950] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.722957] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.722963] Exception stack(0xc403a7b0 to 0xc403a7f8)
[   40.722970] a7a0:                                     aaaaaaaa c403a00c c403a878 c403a878
[   40.722976] a7c0: c403a878 00000005 c403a878 00000005 00000005 c403a000 aaaaad02 c0a1280c
[   40.722983] a7e0: 00000051 c403a800 c0553e40 c0553f78 60000193 ffffffff
[   40.722989] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.722996] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723003] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723010] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723016] Exception stack(0xc403a878 to 0xc403a8c0)
[   40.723022] a860:                                                       aaaaaaaa c403a00c
[   40.723029] a880: c403a940 c403a940 c403a940 00000005 c403a940 00000005 00000005 c403a000
[   40.723035] a8a0: aaaaad02 c0a1280c 00000051 c403a8c8 c0553e40 c0553f78 60000193 ffffffff
[   40.723042] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.723048] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723055] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723062] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723068] Exception stack(0xc403a940 to 0xc403a988)
[   40.723074] a940: aaaaaaaa c403a00c c403aa08 c403aa08 c403aa08 00000005 c403aa08 00000005
[   40.723081] a960: 00000005 c403a000 aaaaad02 c0a1280c 00000051 c403a990 c0553e40 c0553f78
[   40.723087] a980: 60000193 ffffffff
[   40.723093] [<c0100a5c>] (__dabt_svc) from [<c0553f78>] (do_page_fault+0x80/0x3bc)
[   40.723099] [<c0553f78>] (do_page_fault) from [<c0553e40>] (do_translation_fault+0x30/0xe8)
[   40.723106] [<c0553e40>] (do_translation_fault) from [<c0116660>] (do_DataAbort+0x3c/0xc4)
[   40.723113] [<c0116660>] (do_DataAbort) from [<c0100a5c>] (__dabt_svc+0x5c/0xa0)
[   40.723119] Exception stack(0xc403aa08 to 0xc403aa50)
[   40.723125] aa00:                   aaaaaaaa c403a00c c403aad0 c403aad0 c403aad0 00000005
[   40.723144] aa20: c403aad0 00000005 00000005 c403a000 aaaaad02 c0a1280c 00000051 c4
[   40.723195] Lost 157 message(s)!
[   40.723449] CPU0: stopping
[   40.804702] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G      D W         5.12.0-rc4-gc5e3c2361cdd-dirty #1
[   40.805864] Hardware name: Generic DT based system
[   40.806561] [<c0111a74>] (unwind_backtrace) from [<c010d140>] (show_stack+0x10/0x14)
[   40.808075] [<c010d140>] (show_stack) from [<c0452d28>] (dump_stack+0xbc/0x110)
[   40.808935] [<c0452d28>] (dump_stack) from [<c0110978>] (ipi_cpu_stop+0x6c/0x78)
[   40.809717] [<c0110978>] (ipi_cpu_stop) from [<c01106b4>] (ipi_handler+0x0/0x20)
[   40.810485] [<c01106b4>] (ipi_handler) from [<00000014>] (0x14)

Signed-off-by: Sven Van Asbroeck <[email protected]>
TheSven73 pushed a commit that referenced this pull request Apr 23, 2021
At least on ppc64le, RUST_OPT_LEVEL_0/1 causes some functions to be
generated that use up to 20KB of stack. This leads to stack overflow,
which may exhibit as a panic:

  Kernel panic - not syncing: corrupted stack end detected inside scheduler
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc3+ #1

But may also cause other crashes, depending on what is overwritten by
the overflow.

Add a note to the Kconfig for RUST_OPT_LEVEL_0/1 that this can happen.

Signed-off-by: Michael Ellerman <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
In some scenarios (kdump), dpdma hardware irqs has been enabled when
calling request_irq in probe function, and then the dpdma irq handler
xilinx_dpdma_irq_handler is invoked to access xdev->chan[i]. But at
this moment xdev->chan[i] hasn't been initialized.

We should ensure the dpdma controller to be in a consistent and
clean state before further initialization. So add dpdma_hw_init()
to do this.

Furthermore, in xilinx_dpdma_disable_irq, disable all interrupts
instead of error interrupts.

This patch is to fix the kdump kernel crash as below:

[    3.696128] Unable to handle kernel NULL pointer dereference at virtual address 000000000000012c
[    3.696710] xilinx-zynqmp-dpdma fd4c0000.dma-controller: Xilinx DPDMA engine is probed
[    3.704900] Mem abort info:
[    3.704902]   ESR = 0x96000005
[    3.704905]   EC = 0x25: DABT (current EL), IL = 32 bits
[    3.704907]   SET = 0, FnV = 0
[    3.704912]   EA = 0, S1PTW = 0
[    3.713800] ahci-ceva fd0c0000.ahci: supply ahci not found, using dummy regulator
[    3.715585] Data abort info:
[    3.715587]   ISV = 0, ISS = 0x00000005
[    3.715589]   CM = 0, WnR = 0
[    3.715592] [000000000000012c] user address but active_mm is swapper
[    3.715596] Internal error: Oops: 96000005 [#1] SMP
[    3.715599] Modules linked in:
[    3.715608] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-12170-g60894882155f-dirty torvalds#77
[    3.723937] Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
[    3.723942] pstate: 80000085 (Nzcv daIf -PAN -UAO -TCO BTYPE=--)
[    3.723956] pc : xilinx_dpdma_irq_handler+0x418/0x560
[    3.793049] lr : xilinx_dpdma_irq_handler+0x3d8/0x560
[    3.798089] sp : ffffffc01186bdf0
[    3.801388] x29: ffffffc01186bdf0 x28: ffffffc011836f28
[    3.806692] x27: ffffff8023e0ac80 x26: 0000000000000080
[    3.811996] x25: 0000000008000408 x24: 0000000000000003
[    3.817300] x23: ffffffc01186be70 x22: ffffffc011291740
[    3.822604] x21: 0000000000000000 x20: 0000000008000408
[    3.827908] x19: 0000000000000000 x18: 0000000000000010
[    3.833212] x17: 0000000000000000 x16: 0000000000000000
[    3.838516] x15: 0000000000000000 x14: ffffffc011291740
[    3.843820] x13: ffffffc02eb4d000 x12: 0000000034d4d91d
[    3.849124] x11: 0000000000000040 x10: ffffffc0112d2d48
[    3.854428] x9 : ffffffc0112d2d40 x8 : ffffff8021c00268
[    3.859732] x7 : 0000000000000000 x6 : ffffffc011836000
[    3.865036] x5 : 0000000000000003 x4 : 0000000000000000
[    3.870340] x3 : 0000000000000001 x2 : 0000000000000000
[    3.875644] x1 : 0000000000000000 x0 : 000000000000012c
[    3.880948] Call trace:
[    3.883382]  xilinx_dpdma_irq_handler+0x418/0x560
[    3.888079]  __handle_irq_event_percpu+0x5c/0x178
[    3.892774]  handle_irq_event_percpu+0x34/0x98
[    3.897210]  handle_irq_event+0x44/0xb8
[    3.901030]  handle_fasteoi_irq+0xd0/0x190
[    3.905117]  generic_handle_irq+0x30/0x48
[    3.909111]  __handle_domain_irq+0x64/0xc0
[    3.913192]  gic_handle_irq+0x78/0xa0
[    3.916846]  el1_irq+0xc4/0x180
[    3.919982]  cpuidle_enter_state+0x134/0x2f8
[    3.924243]  cpuidle_enter+0x38/0x50
[    3.927810]  call_cpuidle+0x1c/0x40
[    3.931290]  do_idle+0x20c/0x270
[    3.934502]  cpu_startup_entry+0x28/0x58
[    3.938410]  rest_init+0xbc/0xcc
[    3.941631]  arch_call_rest_init+0x10/0x1c
[    3.945718]  start_kernel+0x51c/0x558

Fixes: 7cbb0c6 ("dmaengine: xilinx: dpdma: Add the Xilinx DisplayPort DMA engine driver")
Signed-off-by: Quanyang Wang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Vinod Koul <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
Patch fixes the following critical issue caused by deadlock which has been
detected during testing NCM class:

smp: csd: Detected non-responsive CSD lock (#1) on CPU#0
smp:     csd: CSD lock (#1) unresponsive.
....
RIP: 0010:native_queued_spin_lock_slowpath+0x61/0x1d0
RSP: 0018:ffffbc494011cde0 EFLAGS: 00000002
RAX: 0000000000000101 RBX: ffff9ee8116b4a68 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ee8116b4658
RBP: ffffbc494011cde0 R08: 0000000000000001 R09: 0000000000000000
R10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658
R13: ffff9ee8116b4670 R14: 0000000000000246 R15: ffff9ee8116b4658
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7bcc41a830 CR3: 000000007a612003 CR4: 00000000001706e0
Call Trace:
 <IRQ>
 do_raw_spin_lock+0xc0/0xd0
 _raw_spin_lock_irqsave+0x95/0xa0
 cdnsp_gadget_ep_queue.cold+0x88/0x107 [cdnsp_udc_pci]
 usb_ep_queue+0x35/0x110
 eth_start_xmit+0x220/0x3d0 [u_ether]
 ncm_tx_timeout+0x34/0x40 [usb_f_ncm]
 ? ncm_free_inst+0x50/0x50 [usb_f_ncm]
 __hrtimer_run_queues+0xac/0x440
 hrtimer_run_softirq+0x8c/0xb0
 __do_softirq+0xcf/0x428
 asm_call_irq_on_stack+0x12/0x20
 </IRQ>
 do_softirq_own_stack+0x61/0x70
 irq_exit_rcu+0xc1/0xd0
 sysvec_apic_timer_interrupt+0x52/0xb0
 asm_sysvec_apic_timer_interrupt+0x12/0x20
RIP: 0010:do_raw_spin_trylock+0x18/0x40
RSP: 0018:ffffbc494138bda8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff9ee8116b4658 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9ee8116b4658
RBP: ffffbc494138bda8 R08: 0000000000000001 R09: 0000000000000000
R10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658
R13: ffff9ee8116b4670 R14: ffff9ee7b5c73d80 R15: ffff9ee8116b4000
 _raw_spin_lock+0x3d/0x70
 ? cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]
 cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci]
 ? cdnsp_remove_request+0x1f0/0x1f0 [cdnsp_udc_pci]
 ? cdnsp_thread_irq_handler+0x5/0xa0 [cdnsp_udc_pci]
 ? irq_thread+0xa0/0x1c0
 irq_thread_fn+0x28/0x60
 irq_thread+0x105/0x1c0
 ? __kthread_parkme+0x42/0x90
 ? irq_forced_thread_fn+0x90/0x90
 ? wake_threads_waitq+0x30/0x30
 ? irq_thread_check_affinity+0xe0/0xe0
 kthread+0x12a/0x160
 ? kthread_park+0x90/0x90
 ret_from_fork+0x22/0x30

The root cause of issue is spin_lock/spin_unlock instruction instead
spin_lock_irqsave/spin_lock_irqrestore in cdnsp_thread_irq_handler
function.

Cc: [email protected]
Fixes: 3d82904 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Signed-off-by: Pawel Laszczak <[email protected]>

Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Peter Chen <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
Otherwise, when compiled as module, a WARN_ON is triggered:

WARNING: CPU: 0 PID: 5 at sound/core/init.c:208 snd_card_new+0x310/0x39c [snd]
[...]
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.10.39 #1
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
Workqueue: events deferred_probe_work_func
[<c0111988>] (unwind_backtrace) from [<c010c8ac>] (show_stack+0x10/0x14)
[<c010c8ac>] (show_stack) from [<c092784c>] (dump_stack+0xdc/0x104)
[<c092784c>] (dump_stack) from [<c0129710>] (__warn+0xd8/0x114)
[<c0129710>] (__warn) from [<c0922a48>] (warn_slowpath_fmt+0x5c/0xc4)
[<c0922a48>] (warn_slowpath_fmt) from [<bf0496f8>] (snd_card_new+0x310/0x39c [snd])
[<bf0496f8>] (snd_card_new [snd]) from [<bf1d7df8>] (snd_soc_bind_card+0x334/0x9c4 [snd_soc_core])
[<bf1d7df8>] (snd_soc_bind_card [snd_soc_core]) from [<bf1e9cd8>] (devm_snd_soc_register_card+0x30/0x6c [snd_soc_core])
[<bf1e9cd8>] (devm_snd_soc_register_card [snd_soc_core]) from [<bf22d964>] (fsl_asoc_card_probe+0x550/0xcc8 [snd_soc_fsl_asoc_card])
[<bf22d964>] (fsl_asoc_card_probe [snd_soc_fsl_asoc_card]) from [<c060c930>] (platform_drv_probe+0x48/0x98)
[...]

Signed-off-by: Nicolas Cavallari <[email protected]>
Acked-by: Shengjiu Wang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
After the commit 5ce2dce ("RDMA/ipoib: Set rtnl_link_ops for ipoib
interfaces"), if the IPoIB device is moved to non-initial netns,
destroying that netns lets the device vanish instead of moving it back to
the initial netns, This is happening because default_device_exit() skips
the interfaces due to having rtnl_link_ops set.

Steps to reporoduce:
  ip netns add foo
  ip link set mlx5_ib0 netns foo
  ip netns delete foo

WARNING: CPU: 1 PID: 704 at net/core/dev.c:11435 netdev_exit+0x3f/0x50
Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT
nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack
nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun d
 fuse
CPU: 1 PID: 704 Comm: kworker/u64:3 Tainted: G S      W  5.13.0-rc1+ #1
Hardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.1.5 04/11/2016
Workqueue: netns cleanup_net
RIP: 0010:netdev_exit+0x3f/0x50
Code: 48 8b bb 30 01 00 00 e8 ef 81 b1 ff 48 81 fb c0 3a 54 a1 74 13 48
8b 83 90 00 00 00 48 81 c3 90 00 00 00 48 39 d8 75 02 5b c3 <0f> 0b 5b
c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00
RSP: 0018:ffffb297079d7e08 EFLAGS: 00010206
RAX: ffff8eb542c00040 RBX: ffff8eb541333150 RCX: 000000008010000d
RDX: 000000008010000e RSI: 000000008010000d RDI: ffff8eb440042c00
RBP: ffffb297079d7e48 R08: 0000000000000001 R09: ffffffff9fdeac00
R10: ffff8eb5003be000 R11: 0000000000000001 R12: ffffffffa1545620
R13: ffffffffa1545628 R14: 0000000000000000 R15: ffffffffa1543b20
FS:  0000000000000000(0000) GS:ffff8ed37fa00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005601b5f4c2e8 CR3: 0000001fc8c10002 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ops_exit_list.isra.9+0x36/0x70
 cleanup_net+0x234/0x390
 process_one_work+0x1cb/0x360
 ? process_one_work+0x360/0x360
 worker_thread+0x30/0x370
 ? process_one_work+0x360/0x360
 kthread+0x116/0x130
 ? kthread_park+0x80/0x80
 ret_from_fork+0x22/0x30

To avoid the above warning and later on the kernel panic that could happen
on shutdown due to a NULL pointer dereference, make sure to set the
netns_refund flag that was introduced by commit 3a5ca85 ("can: dev:
Move device back to init netns on owning netns delete") to properly
restore the IPoIB interfaces to the initial netns.

Fixes: 5ce2dce ("RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces")
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Kamal Heib <[email protected]>
Reviewed-by: Leon Romanovsky <[email protected]>
Signed-off-by: Jason Gunthorpe <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
This reverts commit 568262b.

The commit causes the following panic when shutting down a rockpro64-v2
board:

[..]
[   41.684569] xhci-hcd xhci-hcd.2.auto: USB bus 1 deregistered
[   41.686301] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0
[   41.687096] Mem abort info:
[   41.687345]   ESR = 0x96000004
[   41.687615]   EC = 0x25: DABT (current EL), IL = 32 bits
[   41.688082]   SET = 0, FnV = 0
[   41.688352]   EA = 0, S1PTW = 0
[   41.688628] Data abort info:
[   41.688882]   ISV = 0, ISS = 0x00000004
[   41.689219]   CM = 0, WnR = 0
[   41.689481] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000073b2000
[   41.690046] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000
[   41.690654] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[   41.691143] Modules linked in:
[   41.691416] CPU: 5 PID: 1 Comm: shutdown Not tainted 5.13.0-rc4 #43
[   41.691966] Hardware name: Pine64 RockPro64 v2.0 (DT)
[   41.692409] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
[   41.692937] pc : down_read_interruptible+0xec/0x200
[   41.693373] lr : simple_recursive_removal+0x48/0x280
[   41.693815] sp : ffff800011fab910
[   41.694107] x29: ffff800011fab910 x28: ffff0000008fe480 x27: ffff0000008fe4d8
[   41.694736] x26: ffff800011529a90 x25: 00000000000000a0 x24: ffff800011edd030
[   41.695364] x23: 0000000000000080 x22: 0000000000000000 x21: ffff800011f23994
[   41.695992] x20: ffff800011f23998 x19: ffff0000008fe480 x18: ffffffffffffffff
[   41.696620] x17: 000c0400bb44ffff x16: 0000000000000009 x15: ffff800091faba3d
[   41.697248] x14: 0000000000000004 x13: 0000000000000000 x12: 0000000000000020
[   41.697875] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f x9 : 6f6c746364716e62
[   41.698502] x8 : 7f7f7f7f7f7f7f7f x7 : fefefeff6364626d x6 : 0000000000000440
[   41.699130] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000000a0
[   41.699758] x2 : 0000000000000001 x1 : 0000000000000000 x0 : 00000000000000a0
[   41.700386] Call trace:
[   41.700602]  down_read_interruptible+0xec/0x200
[   41.701003]  debugfs_remove+0x5c/0x80
[   41.701328]  dwc3_debugfs_exit+0x1c/0x6c
[   41.701676]  dwc3_remove+0x34/0x1a0
[   41.701988]  platform_remove+0x28/0x60
[   41.702322]  __device_release_driver+0x188/0x22c
[   41.702730]  device_release_driver+0x2c/0x44
[   41.703106]  bus_remove_device+0x124/0x130
[   41.703468]  device_del+0x16c/0x424
[   41.703777]  platform_device_del.part.0+0x1c/0x90
[   41.704193]  platform_device_unregister+0x28/0x44
[   41.704608]  of_platform_device_destroy+0xe8/0x100
[   41.705031]  device_for_each_child_reverse+0x64/0xb4
[   41.705470]  of_platform_depopulate+0x40/0x84
[   41.705853]  __dwc3_of_simple_teardown+0x20/0xd4
[   41.706260]  dwc3_of_simple_shutdown+0x14/0x20
[   41.706652]  platform_shutdown+0x28/0x40
[   41.706998]  device_shutdown+0x158/0x330
[   41.707344]  kernel_power_off+0x38/0x7c
[   41.707684]  __do_sys_reboot+0x16c/0x2a0
[   41.708029]  __arm64_sys_reboot+0x28/0x34
[   41.708383]  invoke_syscall+0x48/0x114
[   41.708716]  el0_svc_common.constprop.0+0x44/0xdc
[   41.709131]  do_el0_svc+0x28/0x90
[   41.709426]  el0_svc+0x2c/0x54
[   41.709698]  el0_sync_handler+0xa4/0x130
[   41.710045]  el0_sync+0x198/0x1c0
[   41.710342] Code: c8047c62 35ffff84 17fffe5f f9800071 (c85ffc60)
[   41.710881] ---[ end trace 406377df5178f75c ]---
[   41.711299] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[   41.712084] Kernel Offset: disabled
[   41.712391] CPU features: 0x10001031,20000846
[   41.712775] Memory Limit: none
[   41.713049] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

As Felipe explained: "dwc3_shutdown() is just called dwc3_remove()
directly, then we end up calling debugfs_remove_recursive() twice."

Reverting the commit fixes the panic.

Fixes: 568262b ("usb: dwc3: core: Add shutdown callback for dwc3")
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Alexandru Elisei <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
…r tcpm port

A pending hrtimer may expire after the kthread_worker of tcpm port
is destroyed, see below kernel dump when do module unload, fix it
by cancel the 2 hrtimers.

[  111.517018] Unable to handle kernel paging request at virtual address ffff8000118cb880
[  111.518786] blk_update_request: I/O error, dev sda, sector 60061185 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  111.526594] Mem abort info:
[  111.526597]   ESR = 0x96000047
[  111.526600]   EC = 0x25: DABT (current EL), IL = 32 bits
[  111.526604]   SET = 0, FnV = 0
[  111.526607]   EA = 0, S1PTW = 0
[  111.526610] Data abort info:
[  111.526612]   ISV = 0, ISS = 0x00000047
[  111.526615]   CM = 0, WnR = 1
[  111.526619] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d75000
[  111.526623] [ffff8000118cb880] pgd=10000001bffff003, p4d=10000001bffff003, pud=10000001bfffe003, pmd=10000001bfffa003, pte=0000000000000000
[  111.526642] Internal error: Oops: 96000047 [#1] PREEMPT SMP
[  111.526647] Modules linked in: dwc3_imx8mp dwc3 phy_fsl_imx8mq_usb [last unloaded: tcpci]
[  111.526663] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc4-00927-gebbe9dbd802c-dirty #36
[  111.526670] Hardware name: NXP i.MX8MPlus EVK board (DT)
[  111.526674] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO BTYPE=--)
[  111.526681] pc : queued_spin_lock_slowpath+0x1a0/0x390
[  111.526695] lr : _raw_spin_lock_irqsave+0x88/0xb4
[  111.526703] sp : ffff800010003e20
[  111.526706] x29: ffff800010003e20 x28: ffff00017f380180
[  111.537156] buffer_io_error: 6 callbacks suppressed
[  111.537162] Buffer I/O error on dev sda1, logical block 60040704, async page read
[  111.539932]  x27: ffff00017f3801c0
[  111.539938] x26: ffff800010ba2490 x25: 0000000000000000 x24: 0000000000000001
[  111.543025] blk_update_request: I/O error, dev sda, sector 60061186 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 0
[  111.548304]
[  111.548306] x23: 00000000000000c0 x22: ffff0000c2a9f184 x21: ffff00017f380180
[  111.551374] Buffer I/O error on dev sda1, logical block 60040705, async page read
[  111.554499]
[  111.554503] x20: ffff0000c5f14210 x19: 00000000000000c0 x18: 0000000000000000
[  111.557391] Buffer I/O error on dev sda1, logical block 60040706, async page read
[  111.561218]
[  111.561222] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[  111.564205] Buffer I/O error on dev sda1, logical block 60040707, async page read
[  111.570887] x14: 00000000000000f5 x13: 0000000000000001 x12: 0000000000000040
[  111.570902] x11: ffff0000c05ac6d8
[  111.583420] Buffer I/O error on dev sda1, logical block 60040708, async page read
[  111.588978]  x10: 0000000000000000 x9 : 0000000000040000
[  111.588988] x8 : 0000000000000000
[  111.597173] Buffer I/O error on dev sda1, logical block 60040709, async page read
[  111.605766]  x7 : ffff00017f384880 x6 : ffff8000118cb880
[  111.605777] x5 : ffff00017f384880
[  111.611094] Buffer I/O error on dev sda1, logical block 60040710, async page read
[  111.617086]  x4 : 0000000000000000 x3 : ffff0000c2a9f184
[  111.617096] x2 : ffff8000118cb880
[  111.622242] Buffer I/O error on dev sda1, logical block 60040711, async page read
[  111.626927]  x1 : ffff8000118cb880 x0 : ffff00017f384888
[  111.626938] Call trace:
[  111.626942]  queued_spin_lock_slowpath+0x1a0/0x390
[  111.795809]  kthread_queue_work+0x30/0xc0
[  111.799828]  state_machine_timer_handler+0x20/0x30
[  111.804624]  __hrtimer_run_queues+0x140/0x1e0
[  111.808990]  hrtimer_interrupt+0xec/0x2c0
[  111.813004]  arch_timer_handler_phys+0x38/0x50
[  111.817456]  handle_percpu_devid_irq+0x88/0x150
[  111.821991]  __handle_domain_irq+0x80/0xe0
[  111.826093]  gic_handle_irq+0xc0/0x140
[  111.829848]  el1_irq+0xbc/0x154
[  111.832991]  arch_cpu_idle+0x1c/0x2c
[  111.836572]  default_idle_call+0x24/0x6c
[  111.840497]  do_idle+0x238/0x2ac
[  111.843729]  cpu_startup_entry+0x2c/0x70
[  111.847657]  rest_init+0xdc/0xec
[  111.850890]  arch_call_rest_init+0x14/0x20
[  111.854988]  start_kernel+0x508/0x540
[  111.858659] Code: 910020e0 8b0200c2 f861d884 aa0203e1 (f8246827)
[  111.864760] ---[ end trace 308b9a4a3dcb73ac ]---
[  111.869381] Kernel panic - not syncing: Oops: Fatal exception in interrupt
[  111.876258] SMP: stopping secondary CPUs
[  111.880185] Kernel Offset: disabled
[  111.883673] CPU features: 0x00001001,20000846
[  111.888031] Memory Limit: none
[  111.891090] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---

Fixes: 3ed8e1c ("usb: typec: tcpm: Migrate workqueue to RT priority for processing events")
Cc: stable <[email protected]>
Reviewed-by: Guenter Roeck <[email protected]>
Signed-off-by: Li Jun <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
Merge branch 'mlxsw-fixes'

Ido Schimmel says:

====================
mlxsw: Thermal and qdisc fixes

Patches #1-#2 fix wrong validation of burst size in qdisc code and a
user triggerable WARN_ON().

Patch #3 fixes a regression in thermal monitoring of transceiver modules
and gearboxes.
====================

Signed-off-by: David S. Miller <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
Some drivers require memory that is marked as EFI boot services
data. In order for this memory to not be re-used by the kernel
after ExitBootServices(), efi_mem_reserve() is used to preserve it
by inserting a new EFI memory descriptor and marking it with the
EFI_MEMORY_RUNTIME attribute.

Under SEV, memory marked with the EFI_MEMORY_RUNTIME attribute needs to
be mapped encrypted by Linux, otherwise the kernel might crash at boot
like below:

  EFI Variables Facility v0.08 2004-May-17
  general protection fault, probably for non-canonical address 0x3597688770a868b2: 0000 [#1] SMP NOPTI
  CPU: 13 PID: 1 Comm: swapper/0 Not tainted 5.12.4-2-default #1 openSUSE Tumbleweed
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:efi_mokvar_entry_next
  [...]
  Call Trace:
   efi_mokvar_sysfs_init
   ? efi_mokvar_table_init
   do_one_initcall
   ? __kmalloc
   kernel_init_freeable
   ? rest_init
   kernel_init
   ret_from_fork

Expand the __ioremap_check_other() function to additionally check for
this other type of boot data reserved at runtime and indicate that it
should be mapped encrypted for an SEV guest.

 [ bp: Massage commit message. ]

Fixes: 58c9090 ("efi: Support for MOK variable config table")
Reported-by: Joerg Roedel <[email protected]>
Signed-off-by: Tom Lendacky <[email protected]>
Signed-off-by: Joerg Roedel <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Tested-by: Joerg Roedel <[email protected]>
Cc: <[email protected]> # 5.10+
Link: https://lkml.kernel.org/r/[email protected]
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
We've suffered from severe kernel crashes due to memory corruption on
our production environment, like,

Call Trace:
[1640542.554277] general protection fault: 0000 [#1] SMP PTI
[1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G
[1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190
[1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286
[1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX:
0000000006e931bf
[1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI:
ffff9a45ff004300
[1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09:
0000000000000000
[1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12:
ffffffff9a20608d
[1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15:
696c662f65636976
[1640542.563128] FS:  00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000)
knlGS:0000000000000000
[1640542.563937] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4:
00000000003606e0
[1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[1640542.566742] Call Trace:
[1640542.567009]  anon_vma_clone+0x5d/0x170
[1640542.567417]  __split_vma+0x91/0x1a0
[1640542.567777]  do_munmap+0x2c6/0x320
[1640542.568128]  vm_munmap+0x54/0x70
[1640542.569990]  __x64_sys_munmap+0x22/0x30
[1640542.572005]  do_syscall_64+0x5b/0x1b0
[1640542.573724]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[1640542.575642] RIP: 0033:0x7f45d6e61e27

James Wang has reproduced it stably on the latest 4.19 LTS.
After some debugging, we finally proved that it's due to ftrace
buffer out-of-bound access using a debug tool as follows:
[   86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000
[   86.780806]  no_context+0xdf/0x3c0
[   86.784327]  __do_page_fault+0x252/0x470
[   86.788367]  do_page_fault+0x32/0x140
[   86.792145]  page_fault+0x1e/0x30
[   86.795576]  strncpy_from_unsafe+0x66/0xb0
[   86.799789]  fetch_memory_string+0x25/0x40
[   86.804002]  fetch_deref_string+0x51/0x60
[   86.808134]  kprobe_trace_func+0x32d/0x3a0
[   86.812347]  kprobe_dispatcher+0x45/0x50
[   86.816385]  kprobe_ftrace_handler+0x90/0xf0
[   86.820779]  ftrace_ops_assist_func+0xa1/0x140
[   86.825340]  0xffffffffc00750bf
[   86.828603]  do_sys_open+0x5/0x1f0
[   86.832124]  do_syscall_64+0x5b/0x1b0
[   86.835900]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

commit b220c04 ("tracing: Check length before giving out
the filter buffer") adds length check to protect trace data
overflow introduced in 0fc1b09, seems that this fix can't prevent
overflow entirely, the length check should also take the sizeof
entry->array[0] into account, since this array[0] is filled the
length of trace data and occupy addtional space and risk overflow.

Link: https://lkml.kernel.org/r/[email protected]

Cc: [email protected]
Cc: Ingo Molnar <[email protected]>
Cc: Xunlei Pang <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Fixes: b220c04 ("tracing: Check length before giving out the filter buffer")
Reviewed-by: Xunlei Pang <[email protected]>
Reviewed-by: yinbinbin <[email protected]>
Reviewed-by: Wetp Zhang <[email protected]>
Tested-by: James Wang <[email protected]>
Signed-off-by: Liangyan <[email protected]>
Signed-off-by: Steven Rostedt (VMware) <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
There is no validation of the index from dwc3_wIndex_to_dep() and we might
be referring a non-existing ep and trigger a NULL pointer exception. In
certain configurations we might use fewer eps and the index might wrongly
indicate a larger ep index than existing.

By adding this validation from the patch we can actually report a wrong
index back to the caller.

In our usecase we are using a composite device on an older kernel, but
upstream might use this fix also. Unfortunately, I cannot describe the
hardware for others to reproduce the issue as it is a proprietary
implementation.

[   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
[   82.966891] Mem abort info:
[   82.969663]   ESR = 0x96000006
[   82.972703]   Exception class = DABT (current EL), IL = 32 bits
[   82.978603]   SET = 0, FnV = 0
[   82.981642]   EA = 0, S1PTW = 0
[   82.984765] Data abort info:
[   82.987631]   ISV = 0, ISS = 0x00000006
[   82.991449]   CM = 0, WnR = 0
[   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
[   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
[   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
[   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
[   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
[   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
[   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94

...

[   83.141788] Call trace:
[   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c
[   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94
[   83.181546] ---[ end trace aac6b5267d84c32f ]---

Signed-off-by: Marian-Cristian Rotariu <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
The sinfo.pertid and sinfo.generation variables are not initialized and
it causes a crash when we use this as a wireless access point.

[  456.873025] ------------[ cut here ]------------
[  456.878198] kernel BUG at mm/slub.c:3968!
[  456.882680] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM

  [ snip ]

[  457.271004] Backtrace:
[  457.273733] [<c02b7ee4>] (kfree) from [<c0e2a470>] (nl80211_send_station+0x954/0xfc4)
[  457.282481]  r9:eccca0c0 r8:e8edfec0 r7:00000000 r6:00000011 r5:e80a9480 r4:e8edfe00
[  457.291132] [<c0e29b1c>] (nl80211_send_station) from [<c0e2b18c>] (cfg80211_new_sta+0x90/0x1cc)
[  457.300850]  r10:e80a9480 r9:e8edfe00 r8:ea678cca r7:00000a20 r6:00000000 r5:ec46d000
[  457.309586]  r4:ec46d9e0
[  457.312433] [<c0e2b0fc>] (cfg80211_new_sta) from [<bf086684>] (rtw_cfg80211_indicate_sta_assoc+0x80/0x9c [r8723bs])
[  457.324095]  r10:00009930 r9:e85b9d80 r8:bf091050 r7:00000000 r6:00000000 r5:0000001c
[  457.332831]  r4:c1606788
[  457.335692] [<bf086604>] (rtw_cfg80211_indicate_sta_assoc [r8723bs]) from [<bf03df38>] (rtw_stassoc_event_callback+0x1c8/0x1d4 [r8723bs])
[  457.349489]  r7:ea678cc0 r6:000000a1 r5:f1225f84 r4:f086b000
[  457.355845] [<bf03dd70>] (rtw_stassoc_event_callback [r8723bs]) from [<bf048e4c>] (mlme_evt_hdl+0x8c/0xb4 [r8723bs])
[  457.367601]  r7:c1604900 r6:f086c4b8 r5:00000000 r4:f086c000
[  457.373959] [<bf048dc0>] (mlme_evt_hdl [r8723bs]) from [<bf03693c>] (rtw_cmd_thread+0x198/0x3d8 [r8723bs])
[  457.384744]  r5:f086e000 r4:f086c000
[  457.388754] [<bf0367a4>] (rtw_cmd_thread [r8723bs]) from [<c014a214>] (kthread+0x170/0x174)
[  457.398083]  r10:ed7a57e8 r9:bf0367a4 r8:f086b000 r7:e8ede000 r6:00000000 r5:e9975200
[  457.406828]  r4:e8369900
[  457.409653] [<c014a0a4>] (kthread) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
[  457.417718] Exception stack(0xe8edffb0 to 0xe8edfff8)
[  457.423356] ffa0:                                     00000000 00000000 00000000 00000000
[  457.432492] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  457.441618] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  457.449006]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c014a0a4
[  457.457750]  r4:e9975200
[  457.460574] Code: 1a000003 e5953004 e3130001 1a000000 (e7f001f2)
[  457.467381] ---[ end trace 4acbc8c15e9e6aa7 ]---

Link: https://forum.armbian.com/topic/14727-wifi-ap-kernel-bug-in-kernel-5444/
Fixes: 8689c05 ("cfg80211: dynamically allocate per-tid stats for station info")
Fixes: f5ea912 ("nl80211: add generation number to all dumps")
Signed-off-by: Wenli Looi <[email protected]>
Reviewed-by: Dan Carpenter <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
When user space brings PKRU into init state, then the kernel handling is
broken:

  T1 user space
     xsave(state)
     state.header.xfeatures &= ~XFEATURE_MASK_PKRU;
     xrstor(state)

  T1 -> kernel
     schedule()
       XSAVE(S) -> T1->xsave.header.xfeatures[PKRU] == 0
       T1->flags |= TIF_NEED_FPU_LOAD;

       wrpkru();

     schedule()
       ...
       pk = get_xsave_addr(&T1->fpu->state.xsave, XFEATURE_PKRU);
       if (pk)
	 wrpkru(pk->pkru);
       else
	 wrpkru(DEFAULT_PKRU);

Because the xfeatures bit is 0 and therefore the value in the xsave
storage is not valid, get_xsave_addr() returns NULL and switch_to()
writes the default PKRU. -> FAIL #1!

So that wrecks any copy_to/from_user() on the way back to user space
which hits memory which is protected by the default PKRU value.

Assumed that this does not fail (pure luck) then T1 goes back to user
space and because TIF_NEED_FPU_LOAD is set it ends up in

  switch_fpu_return()
      __fpregs_load_activate()
        if (!fpregs_state_valid()) {
  	 load_XSTATE_from_task();
        }

But if nothing touched the FPU between T1 scheduling out and back in,
then the fpregs_state is still valid which means switch_fpu_return()
does nothing and just clears TIF_NEED_FPU_LOAD. Back to user space with
DEFAULT_PKRU loaded. -> FAIL #2!

The fix is simple: if get_xsave_addr() returns NULL then set the
PKRU value to 0 instead of the restrictive default PKRU value in
init_pkru_value.

 [ bp: Massage in minor nitpicks from folks. ]

Fixes: 0cecca9 ("x86/fpu: Eager switch PKRU state")
Signed-off-by: Thomas Gleixner <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Acked-by: Dave Hansen <[email protected]>
Acked-by: Rik van Riel <[email protected]>
Tested-by: Babu Moger <[email protected]>
Cc: [email protected]
Link: https://lkml.kernel.org/r/[email protected]
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
When adding a hairpin flow, a firmware-side send queue is created for
the peer net device, which claims some host memory pages for its
internal ring buffer. If the peer net device is removed/unbound before
the hairpin flow is deleted, then the send queue is not destroyed which
leads to a stack trace on pci device remove:

[ 748.005230] mlx5_core 0000:08:00.2: wait_func:1094:(pid 12985): MANAGE_PAGES(0x108) timeout. Will cause a leak of a command resource
[ 748.005231] mlx5_core 0000:08:00.2: reclaim_pages:514:(pid 12985): failed reclaiming pages: err -110
[ 748.001835] mlx5_core 0000:08:00.2: mlx5_reclaim_root_pages:653:(pid 12985): failed reclaiming pages (-110) for func id 0x0
[ 748.002171] ------------[ cut here ]------------
[ 748.001177] FW pages counter is 4 after reclaiming all pages
[ 748.001186] WARNING: CPU: 1 PID: 12985 at drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c:685 mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core]                      [  +0.002771] Modules linked in: cls_flower mlx5_ib mlx5_core ptp pps_core act_mirred sch_ingress openvswitch nsh xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay fuse [last unloaded: pps_core]
[ 748.007225] CPU: 1 PID: 12985 Comm: tee Not tainted 5.12.0+ #1
[ 748.001376] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[ 748.002315] RIP: 0010:mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core]
[ 748.001679] Code: 28 00 00 00 0f 85 22 01 00 00 48 81 c4 b0 00 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 40 cc 19 a1 e8 9f 71 0e e2 <0f> 0b e9 30 ff ff ff 48 c7 c7 a0 cc 19 a1 e8 8c 71 0e e2 0f 0b e9
[ 748.003781] RSP: 0018:ffff88815220faf8 EFLAGS: 00010286
[ 748.001149] RAX: 0000000000000000 RBX: ffff8881b4900280 RCX: 0000000000000000
[ 748.001445] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102a441f51
[ 748.001614] RBP: 00000000000032b9 R08: 0000000000000001 R09: ffffed1054a15ee8
[ 748.001446] R10: ffff8882a50af73b R11: ffffed1054a15ee7 R12: fffffbfff07c1e30
[ 748.001447] R13: dffffc0000000000 R14: ffff8881b492cba8 R15: 0000000000000000
[ 748.001429] FS:  00007f58bd08b580(0000) GS:ffff8882a5080000(0000) knlGS:0000000000000000
[ 748.001695] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 748.001309] CR2: 000055a026351740 CR3: 00000001d3b48006 CR4: 0000000000370ea0
[ 748.001506] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 748.001483] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 748.001654] Call Trace:
[ 748.000576]  ? mlx5_satisfy_startup_pages+0x290/0x290 [mlx5_core]
[ 748.001416]  ? mlx5_cmd_teardown_hca+0xa2/0xd0 [mlx5_core]
[ 748.001354]  ? mlx5_cmd_init_hca+0x280/0x280 [mlx5_core]
[ 748.001203]  mlx5_function_teardown+0x30/0x60 [mlx5_core]
[ 748.001275]  mlx5_uninit_one+0xa7/0xc0 [mlx5_core]
[ 748.001200]  remove_one+0x5f/0xc0 [mlx5_core]
[ 748.001075]  pci_device_remove+0x9f/0x1d0
[ 748.000833]  device_release_driver_internal+0x1e0/0x490
[ 748.001207]  unbind_store+0x19f/0x200
[ 748.000942]  ? sysfs_file_ops+0x170/0x170
[ 748.001000]  kernfs_fop_write_iter+0x2bc/0x450
[ 748.000970]  new_sync_write+0x373/0x610
[ 748.001124]  ? new_sync_read+0x600/0x600
[ 748.001057]  ? lock_acquire+0x4d6/0x700
[ 748.000908]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 748.001126]  ? fd_install+0x1c9/0x4d0
[ 748.000951]  vfs_write+0x4d0/0x800
[ 748.000804]  ksys_write+0xf9/0x1d0
[ 748.000868]  ? __x64_sys_read+0xb0/0xb0
[ 748.000811]  ? filp_open+0x50/0x50
[ 748.000919]  ? syscall_enter_from_user_mode+0x1d/0x50
[ 748.001223]  do_syscall_64+0x3f/0x80
[ 748.000892]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 748.001026] RIP: 0033:0x7f58bcfb22f7
[ 748.000944] Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
[ 748.003925] RSP: 002b:00007fffd7f2aaa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 748.001732] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007f58bcfb22f7
[ 748.001426] RDX: 000000000000000d RSI: 00007fffd7f2abc0 RDI: 0000000000000003
[ 748.001746] RBP: 00007fffd7f2abc0 R08: 0000000000000000 R09: 0000000000000001
[ 748.001631] R10: 00000000000001b6 R11: 0000000000000246 R12: 000000000000000d
[ 748.001537] R13: 00005597ac2c24a0 R14: 000000000000000d R15: 00007f58bd084700
[ 748.001564] irq event stamp: 0
[ 748.000787] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[ 748.001399] hardirqs last disabled at (0): [<ffffffff813132cf>] copy_process+0x146f/0x5eb0
[ 748.001854] softirqs last  enabled at (0): [<ffffffff8131330e>] copy_process+0x14ae/0x5eb0
[ 748.013431] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 748.001492] ---[ end trace a6fabd773d1c51ae ]---

Fix by destroying the send queue of a hairpin peer net device that is
being removed/unbound, which returns the allocated ring buffer pages to
the host.

Fixes: 4d8fcf2 ("net/mlx5e: Avoid unbounded peer devices when unpairing TC hairpin rules")
Signed-off-by: Dima Chumak <[email protected]>
Reviewed-by: Roi Dayan <[email protected]>
Signed-off-by: Saeed Mahameed <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
The value mr->sig is stored in the entry upon mr allocation, however, ibmr
is wrongly entered here as "old", therefore, xa_cmpxchg() does not replace
the entry with NULL, which leads to the following trace:

 WARNING: CPU: 28 PID: 2078 at drivers/infiniband/hw/mlx5/main.c:3643 mlx5_ib_stage_init_cleanup+0x4d/0x60 [mlx5_ib]
 Modules linked in: nvme_rdma nvme_fabrics nvme_core 8021q garp mrp bonding bridge stp llc rfkill rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_tad
 CPU: 28 PID: 2078 Comm: reboot Tainted: G               X --------- ---  5.13.0-0.rc2.19.el9.x86_64 #1
 Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.9.1 12/07/2018
 RIP: 0010:mlx5_ib_stage_init_cleanup+0x4d/0x60 [mlx5_ib]
 Code: 8d bb 70 1f 00 00 be 00 01 00 00 e8 9d 94 ce da 48 3d 00 01 00 00 75 02 5b c3 0f 0b 5b c3 0f 0b 48 83 bb b0 20 00 00 00 74 d5 <0f> 0b eb d1 4
 RSP: 0018:ffffa8db06d33c90 EFLAGS: 00010282
 RAX: 0000000000000000 RBX: ffff97f890a44000 RCX: ffff97f900ec0160
 RDX: 0000000000000000 RSI: 0000000080080001 RDI: ffff97f890a44000
 RBP: ffffffffc0c189b8 R08: 0000000000000001 R09: 0000000000000000
 R10: 0000000000000001 R11: 0000000000000300 R12: ffff97f890a44000
 R13: ffffffffc0c36030 R14: 00000000fee1dead R15: 0000000000000000
 FS:  00007f0d5a8a3b40(0000) GS:ffff98077fb80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000555acbf4f450 CR3: 00000002a6f56002 CR4: 00000000001706e0
 Call Trace:
  mlx5r_remove+0x39/0x60 [mlx5_ib]
  auxiliary_bus_remove+0x1b/0x30
  __device_release_driver+0x17a/0x230
  device_release_driver+0x24/0x30
  bus_remove_device+0xdb/0x140
  device_del+0x18b/0x3e0
  mlx5_detach_device+0x59/0x90 [mlx5_core]
  mlx5_unload_one+0x22/0x60 [mlx5_core]
  shutdown+0x31/0x3a [mlx5_core]
  pci_device_shutdown+0x34/0x60
  device_shutdown+0x15b/0x1c0
  __do_sys_reboot.cold+0x2f/0x5b
  ? vfs_writev+0xc7/0x140
  ? handle_mm_fault+0xc5/0x290
  ? do_writev+0x6b/0x110
  do_syscall_64+0x40/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: e6fb246 ("RDMA/mlx5: Consolidate MR destruction to mlx5_ib_dereg_mr()")
Link: https://lore.kernel.org/r/f3f585ea0db59c2a78f94f65eedeafc5a2374993.1623309971.git.leonro@nvidia.com
Signed-off-by: Aharon Landau <[email protected]>
Signed-off-by: Leon Romanovsky <[email protected]>
Signed-off-by: Jason Gunthorpe <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
Immediately reset the MMU context when the vCPU's SMM flag is cleared so
that the SMM flag in the MMU role is always synchronized with the vCPU's
flag.  If RSM fails (which isn't correctly emulated), KVM will bail
without calling post_leave_smm() and leave the MMU in a bad state.

The bad MMU role can lead to a NULL pointer dereference when grabbing a
shadow page's rmap for a page fault as the initial lookups for the gfn
will happen with the vCPU's SMM flag (=0), whereas the rmap lookup will
use the shadow page's SMM flag, which comes from the MMU (=1).  SMM has
an entirely different set of memslots, and so the initial lookup can find
a memslot (SMM=0) and then explode on the rmap memslot lookup (SMM=1).

  general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  CPU: 1 PID: 8410 Comm: syz-executor382 Not tainted 5.13.0-rc5-syzkaller #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  RIP: 0010:__gfn_to_rmap arch/x86/kvm/mmu/mmu.c:935 [inline]
  RIP: 0010:gfn_to_rmap+0x2b0/0x4d0 arch/x86/kvm/mmu/mmu.c:947
  Code: <42> 80 3c 20 00 74 08 4c 89 ff e8 f1 79 a9 00 4c 89 fb 4d 8b 37 44
  RSP: 0018:ffffc90000ffef98 EFLAGS: 00010246
  RAX: 0000000000000000 RBX: ffff888015b9f414 RCX: ffff888019669c40
  RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
  RBP: 0000000000000001 R08: ffffffff811d9cdb R09: ffffed10065a6002
  R10: ffffed10065a6002 R11: 0000000000000000 R12: dffffc0000000000
  R13: 0000000000000003 R14: 0000000000000001 R15: 0000000000000000
  FS:  000000000124b300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 0000000028e31000 CR4: 00000000001526e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   rmap_add arch/x86/kvm/mmu/mmu.c:965 [inline]
   mmu_set_spte+0x862/0xe60 arch/x86/kvm/mmu/mmu.c:2604
   __direct_map arch/x86/kvm/mmu/mmu.c:2862 [inline]
   direct_page_fault+0x1f74/0x2b70 arch/x86/kvm/mmu/mmu.c:3769
   kvm_mmu_do_page_fault arch/x86/kvm/mmu.h:124 [inline]
   kvm_mmu_page_fault+0x199/0x1440 arch/x86/kvm/mmu/mmu.c:5065
   vmx_handle_exit+0x26/0x160 arch/x86/kvm/vmx/vmx.c:6122
   vcpu_enter_guest+0x3bdd/0x9630 arch/x86/kvm/x86.c:9428
   vcpu_run+0x416/0xc20 arch/x86/kvm/x86.c:9494
   kvm_arch_vcpu_ioctl_run+0x4e8/0xa40 arch/x86/kvm/x86.c:9722
   kvm_vcpu_ioctl+0x70f/0xbb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3460
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:1069 [inline]
   __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:1055
   do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  RIP: 0033:0x440ce9

Cc: [email protected]
Reported-by: [email protected]
Fixes: 9ec1949 ("KVM: x86: clear SMM flags before loading state while leaving SMM")
Signed-off-by: Sean Christopherson <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
There is a panic in socket ioctl cmd SIOCGSKNS when NET_NS is not enabled.
The reason is that nsfs tries to access ns->ops but the proc_ns_operations
is not implemented in this case.

[7.670023] Unable to handle kernel NULL pointer dereference at virtual address 00000010
[7.670268] pgd = 32b54000
[7.670544] [00000010] *pgd=00000000
[7.671861] Internal error: Oops: 5 [#1] SMP ARM
[7.672315] Modules linked in:
[7.672918] CPU: 0 PID: 1 Comm: systemd Not tainted 5.13.0-rc3-00375-g6799d4f2da49 #16
[7.673309] Hardware name: Generic DT based system
[7.673642] PC is at nsfs_evict+0x24/0x30
[7.674486] LR is at clear_inode+0x20/0x9c

The same to tun SIOCGSKNS command.

To fix this problem, we make get_net_ns() return -EINVAL when NET_NS is
disabled. Meanwhile move it to right place net/core/net_namespace.c.

Signed-off-by: Changbin Du <[email protected]>
Fixes: c62cce2 ("net: add an ioctl to get a socket network namespace")
Cc: Cong Wang <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: David Laight <[email protected]>
Cc: Christian Brauner <[email protected]>
Suggested-by: Jakub Kicinski <[email protected]>
Acked-by: Christian Brauner <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
Our syzkaller trigger the "BUG_ON(!list_empty(&inode->i_wb_list))" in
clear_inode:

  kernel BUG at fs/inode.c:519!
  Internal error: Oops - BUG: 0 [#1] SMP
  Modules linked in:
  Process syz-executor.0 (pid: 249, stack limit = 0x00000000a12409d7)
  CPU: 1 PID: 249 Comm: syz-executor.0 Not tainted 4.19.95
  Hardware name: linux,dummy-virt (DT)
  pstate: 80000005 (Nzcv daif -PAN -UAO)
  pc : clear_inode+0x280/0x2a8
  lr : clear_inode+0x280/0x2a8
  Call trace:
    clear_inode+0x280/0x2a8
    ext4_clear_inode+0x38/0xe8
    ext4_free_inode+0x130/0xc68
    ext4_evict_inode+0xb20/0xcb8
    evict+0x1a8/0x3c0
    iput+0x344/0x460
    do_unlinkat+0x260/0x410
    __arm64_sys_unlinkat+0x6c/0xc0
    el0_svc_common+0xdc/0x3b0
    el0_svc_handler+0xf8/0x160
    el0_svc+0x10/0x218
  Kernel panic - not syncing: Fatal exception

A crash dump of this problem show that someone called __munlock_pagevec
to clear page LRU without lock_page: do_mmap -> mmap_region -> do_munmap
-> munlock_vma_pages_range -> __munlock_pagevec.

As a result memory_failure will call identify_page_state without
wait_on_page_writeback.  And after truncate_error_page clear the mapping
of this page.  end_page_writeback won't call sb_clear_inode_writeback to
clear inode->i_wb_list.  That will trigger BUG_ON in clear_inode!

Fix it by checking PageWriteback too to help determine should we skip
wait_on_page_writeback.

Link: https://lkml.kernel.org/r/[email protected]
Fixes: 0bc1f8b ("hwpoison: fix the handling path of the victimized page frame that belong to non-LRU")
Signed-off-by: yangerkun <[email protected]>
Acked-by: Naoya Horiguchi <[email protected]>
Cc: Jan Kara <[email protected]>
Cc: Theodore Ts'o <[email protected]>
Cc: Oscar Salvador <[email protected]>
Cc: Yu Kuai <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
The device can be requested to be attached despite being not probed.
This situation is possible if devlink reload races with module removal,
and the following kernel panic is an outcome of such race.

 mlx5_core 0000:00:09.0: firmware version: 4.7.9999
 mlx5_core 0000:00:09.0: 0.000 Gb/s available PCIe bandwidth (8.0 GT/s PCIe x255 link)
 BUG: unable to handle page fault for address: fffffffffffffff0
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 3218067 P4D 3218067 PUD 321a067 PMD 0
 Oops: 0000 [#1] SMP KASAN NOPTI
 CPU: 7 PID: 250 Comm: devlink Not tainted 5.12.0-rc2+ #2836
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 RIP: 0010:mlx5_attach_device+0x80/0x280 [mlx5_core]
 Code: f8 48 c1 e8 03 42 80 3c 38 00 0f 85 80 01 00 00 48 8b 45 68 48 8d 78 f0 48 89 fe 48 c1 ee 03 42 80 3c 3e 00 0f 85 70 01 00 00 <48> 8b 40 f0 48 85 c0 74 0d 48 89 ef ff d0 85 c0 0f 85 84 05 0e 00
 RSP: 0018:ffff8880129675f0 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff827407f1
 RDX: 1ffff110011336cf RSI: 1ffffffffffffffe RDI: fffffffffffffff0
 RBP: ffff888008e0c000 R08: 0000000000000008 R09: ffffffffa0662ee7
 R10: fffffbfff40cc5dc R11: 0000000000000000 R12: ffff88800ea002e0
 R13: ffffed1001d459f7 R14: ffffffffa05ef4f8 R15: dffffc0000000000
 FS:  00007f51dfeaf740(0000) GS:ffff88806d5c0000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: fffffffffffffff0 CR3: 000000000bc82006 CR4: 0000000000370ea0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
  mlx5_load_one+0x117/0x1d0 [mlx5_core]
  devlink_reload+0x2d5/0x520
  ? devlink_remote_reload_actions_performed+0x30/0x30
  ? mutex_trylock+0x24b/0x2d0
  ? devlink_nl_cmd_reload+0x62b/0x1070
  devlink_nl_cmd_reload+0x66d/0x1070
  ? devlink_reload+0x520/0x520
  ? devlink_nl_pre_doit+0x64/0x4d0
  genl_family_rcv_msg_doit+0x1e9/0x2f0
  ? mutex_lock_io_nested+0x1130/0x1130
  ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240
  ? security_capable+0x51/0x90
  genl_rcv_msg+0x27f/0x4a0
  ? genl_get_cmd+0x3c0/0x3c0
  ? lock_acquire+0x1a9/0x6d0
  ? devlink_reload+0x520/0x520
  ? lock_release+0x6c0/0x6c0
  netlink_rcv_skb+0x11d/0x340
  ? genl_get_cmd+0x3c0/0x3c0
  ? netlink_ack+0x9f0/0x9f0
  ? lock_release+0x1f9/0x6c0
  genl_rcv+0x24/0x40
  netlink_unicast+0x433/0x700
  ? netlink_attachskb+0x730/0x730
  ? _copy_from_iter_full+0x178/0x650
  ? __alloc_skb+0x113/0x2b0
  netlink_sendmsg+0x6f1/0xbd0
  ? netlink_unicast+0x700/0x700
  ? netlink_unicast+0x700/0x700
  sock_sendmsg+0xb0/0xe0
  __sys_sendto+0x193/0x240
  ? __x64_sys_getpeername+0xb0/0xb0
  ? copy_page_range+0x2300/0x2300
  ? __up_read+0x1a1/0x7b0
  ? do_user_addr_fault+0x219/0xdc0
  __x64_sys_sendto+0xdd/0x1b0
  ? syscall_enter_from_user_mode+0x1d/0x50
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f51dffb514a
 Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c
 RSP: 002b:00007ffcaef22e78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f51dffb514a
 RDX: 0000000000000030 RSI: 000055750daf2440 RDI: 0000000000000003
 RBP: 000055750daf2410 R08: 00007f51e0081200 R09: 000000000000000c
 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 Modules linked in: mlx5_core(-) ptp pps_core ib_ipoib rdma_ucm rdma_cm iw_cm ib_cm ib_umad ib_uverbs ib_core [last unloaded: mlx5_ib]
 CR2: fffffffffffffff0
 ---[ end trace 7789831bfe74fa42 ]---

Fixes: a925b5e ("net/mlx5: Register mlx5 devices to auxiliary virtual bus")
Signed-off-by: Leon Romanovsky <[email protected]>
Reviewed-by: Parav Pandit <[email protected]>
Signed-off-by: Saeed Mahameed <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
…t set

On systems without any specific PMU driver support registered, running
perf record causes Oops.

The relevant portion from call trace:

  BUG: Kernel NULL pointer dereference on read at 0x00000040
  Faulting instruction address: 0xc0021f0c
  Oops: Kernel access of bad area, sig: 11 [#1]
  BE PAGE_SIZE=4K PREEMPT CMPCPRO
  SAF3000 DIE NOTIFICATION
  CPU: 0 PID: 442 Comm: null_syscall Not tainted 5.13.0-rc6-s3k-dev-01645-g7649ee3d2957 #5164
  NIP:  c0021f0c LR: c00e8ad8 CTR: c00d8a5c
  NIP perf_instruction_pointer+0x10/0x60
  LR  perf_prepare_sample+0x344/0x674
  Call Trace:
    perf_prepare_sample+0x7c/0x674 (unreliable)
    perf_event_output_forward+0x3c/0x94
    __perf_event_overflow+0x74/0x14c
    perf_swevent_hrtimer+0xf8/0x170
    __hrtimer_run_queues.constprop.0+0x160/0x318
    hrtimer_interrupt+0x148/0x3b0
    timer_interrupt+0xc4/0x22c
    Decrementer_virt+0xb8/0xbc

During perf record session, perf_instruction_pointer() is called to
capture the sample IP. This function in core-book3s accesses
ppmu->flags. If a platform specific PMU driver is not registered, ppmu
is set to NULL and accessing its members results in a crash. Fix this
crash by checking if ppmu is set.

Fixes: 2ca13a4 ("powerpc/perf: Use regs->nip when SIAR is zero")
Cc: [email protected] # v5.11+
Reported-by: Christophe Leroy <[email protected]>
Signed-off-by: Athira Rajeev <[email protected]>
Tested-by: Christophe Leroy <[email protected]>
Signed-off-by: Michael Ellerman <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
Andreas reported commit fc85047 ("riscv: bpf: Avoid breaking W^X")
breaks booting with one kind of defconfig, I reproduced a kernel panic
with the defconfig:

[    0.138553] Unable to handle kernel paging request at virtual address ffffffff81201220
[    0.139159] Oops [#1]
[    0.139303] Modules linked in:
[    0.139601] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc5-default+ #1
[    0.139934] Hardware name: riscv-virtio,qemu (DT)
[    0.140193] epc : __memset+0xc4/0xfc
[    0.140416]  ra : skb_flow_dissector_init+0x1e/0x82
[    0.140609] epc : ffffffff8029806c ra : ffffffff8033be78 sp : ffffffe001647da0
[    0.140878]  gp : ffffffff81134b08 tp : ffffffe001654380 t0 : ffffffff81201158
[    0.141156]  t1 : 0000000000000002 t2 : 0000000000000154 s0 : ffffffe001647dd0
[    0.141424]  s1 : ffffffff80a43250 a0 : ffffffff81201220 a1 : 0000000000000000
[    0.141654]  a2 : 000000000000003c a3 : ffffffff81201258 a4 : 0000000000000064
[    0.141893]  a5 : ffffffff8029806c a6 : 0000000000000040 a7 : ffffffffffffffff
[    0.142126]  s2 : ffffffff81201220 s3 : 0000000000000009 s4 : ffffffff81135088
[    0.142353]  s5 : ffffffff81135038 s6 : ffffffff8080ce80 s7 : ffffffff80800438
[    0.142584]  s8 : ffffffff80bc6578 s9 : 0000000000000008 s10: ffffffff806000ac
[    0.142810]  s11: 0000000000000000 t3 : fffffffffffffffc t4 : 0000000000000000
[    0.143042]  t5 : 0000000000000155 t6 : 00000000000003ff
[    0.143220] status: 0000000000000120 badaddr: ffffffff81201220 cause: 000000000000000f
[    0.143560] [<ffffffff8029806c>] __memset+0xc4/0xfc
[    0.143859] [<ffffffff8061e984>] init_default_flow_dissectors+0x22/0x60
[    0.144092] [<ffffffff800010fc>] do_one_initcall+0x3e/0x168
[    0.144278] [<ffffffff80600df0>] kernel_init_freeable+0x1c8/0x224
[    0.144479] [<ffffffff804868a8>] kernel_init+0x12/0x110
[    0.144658] [<ffffffff800022de>] ret_from_exception+0x0/0xc
[    0.145124] ---[ end trace f1e9643daa46d591 ]---

After some investigation, I think I found the root cause: commit
2bfc6cd ("move kernel mapping outside of linear mapping") moves
BPF JIT region after the kernel:

| #define BPF_JIT_REGION_START	PFN_ALIGN((unsigned long)&_end)

The &_end is unlikely aligned with PMD size, so the front bpf jit
region sits with part of kernel .data section in one PMD size mapping.
But kernel is mapped in PMD SIZE, when bpf_jit_binary_lock_ro() is
called to make the first bpf jit prog ROX, we will make part of kernel
.data section RO too, so when we write to, for example memset the
.data section, MMU will trigger a store page fault.

To fix the issue, we need to ensure the BPF JIT region is PMD size
aligned. This patch acchieve this goal by restoring the BPF JIT region
to original position, I.E the 128MB before kernel .text section. The
modification to kasan_init.c is inspired by Alexandre.

Fixes: fc85047 ("riscv: bpf: Avoid breaking W^X")
Reported-by: Andreas Schwab <[email protected]>
Signed-off-by: Jisheng Zhang <[email protected]>
Signed-off-by: Palmer Dabbelt <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
ASan reported a memory leak of BPF-related ksymbols map and dso. The
leak is caused by refount never reaching 0, due to missing __put calls
in the function machine__process_ksymbol_register.

Once the dso is inserted in the map, dso__put() should be called
(map__new2() increases the refcount to 2).

The same thing applies for the map when it's inserted into maps
(maps__insert() increases the refcount to 2).

  $ sudo ./perf record -- sleep 5
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 0.025 MB perf.data (8 samples) ]

  =================================================================
  ==297735==ERROR: LeakSanitizer: detected memory leaks

  Direct leak of 6992 byte(s) in 19 object(s) allocated from:
      #0 0x4f43c7 in calloc (/home/user/linux/tools/perf/perf+0x4f43c7)
      #1 0x8e4e53 in map__new2 /home/user/linux/tools/perf/util/map.c:216:20
      #2 0x8cf68c in machine__process_ksymbol_register /home/user/linux/tools/perf/util/machine.c:778:10
      [...]

  Indirect leak of 8702 byte(s) in 19 object(s) allocated from:
      #0 0x4f43c7 in calloc (/home/user/linux/tools/perf/perf+0x4f43c7)
      #1 0x8728d7 in dso__new_id /home/user/linux/tools/perf/util/dso.c:1256:20
      #2 0x872015 in dso__new /home/user/linux/tools/perf/util/dso.c:1295:9
      #3 0x8cf623 in machine__process_ksymbol_register /home/user/linux/tools/perf/util/machine.c:774:21
      [...]

  Indirect leak of 1520 byte(s) in 19 object(s) allocated from:
      #0 0x4f43c7 in calloc (/home/user/linux/tools/perf/perf+0x4f43c7)
      #1 0x87b3da in symbol__new /home/user/linux/tools/perf/util/symbol.c:269:23
      #2 0x888954 in map__process_kallsym_symbol /home/user/linux/tools/perf/util/symbol.c:710:8
      [...]

  Indirect leak of 1406 byte(s) in 19 object(s) allocated from:
      #0 0x4f43c7 in calloc (/home/user/linux/tools/perf/perf+0x4f43c7)
      #1 0x87b3da in symbol__new /home/user/linux/tools/perf/util/symbol.c:269:23
      #2 0x8cfbd8 in machine__process_ksymbol_register /home/user/linux/tools/perf/util/machine.c:803:8
      [...]

Signed-off-by: Riccardo Mancini <[email protected]>
Cc: Adrian Hunter <[email protected]>
Cc: Alexander Shishkin <[email protected]>
Cc: Andi Kleen <[email protected]>
Cc: Ian Rogers <[email protected]>
Cc: Jiapeng Chong <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Mark Rutland <[email protected]>
Cc: Namhyung Kim <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Tommi Rantala <[email protected]>
Link: http://lore.kernel.org/lkml/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
TheSven73 pushed a commit that referenced this pull request Jun 29, 2021
This reverts commit 1815d9c.

Unfortunately this inverts the locking hierarchy, so back to the
drawing board. Full lockdep splat below:

======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc7-CI-CI_DRM_10254+ #1 Not tainted
------------------------------------------------------
kms_frontbuffer/1087 is trying to acquire lock:
ffff88810dcd01a8 (&dev->master_mutex){+.+.}-{3:3}, at: drm_is_current_master+0x1b/0x40
but task is already holding lock:
ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&dev->mode_config.mutex){+.+.}-{3:3}:
       __mutex_lock+0xab/0x970
       drm_client_modeset_probe+0x22e/0xca0
       __drm_fb_helper_initial_config_and_unlock+0x42/0x540
       intel_fbdev_initial_config+0xf/0x20 [i915]
       async_run_entry_fn+0x28/0x130
       process_one_work+0x26d/0x5c0
       worker_thread+0x37/0x380
       kthread+0x144/0x170
       ret_from_fork+0x1f/0x30
-> #1 (&client->modeset_mutex){+.+.}-{3:3}:
       __mutex_lock+0xab/0x970
       drm_client_modeset_commit_locked+0x1c/0x180
       drm_client_modeset_commit+0x1c/0x40
       __drm_fb_helper_restore_fbdev_mode_unlocked+0x88/0xb0
       drm_fb_helper_set_par+0x34/0x40
       intel_fbdev_set_par+0x11/0x40 [i915]
       fbcon_init+0x270/0x4f0
       visual_init+0xc6/0x130
       do_bind_con_driver+0x1e5/0x2d0
       do_take_over_console+0x10e/0x180
       do_fbcon_takeover+0x53/0xb0
       register_framebuffer+0x22d/0x310
       __drm_fb_helper_initial_config_and_unlock+0x36c/0x540
       intel_fbdev_initial_config+0xf/0x20 [i915]
       async_run_entry_fn+0x28/0x130
       process_one_work+0x26d/0x5c0
       worker_thread+0x37/0x380
       kthread+0x144/0x170
       ret_from_fork+0x1f/0x30
-> #0 (&dev->master_mutex){+.+.}-{3:3}:
       __lock_acquire+0x151e/0x2590
       lock_acquire+0xd1/0x3d0
       __mutex_lock+0xab/0x970
       drm_is_current_master+0x1b/0x40
       drm_mode_getconnector+0x37e/0x4a0
       drm_ioctl_kernel+0xa8/0xf0
       drm_ioctl+0x1e8/0x390
       __x64_sys_ioctl+0x6a/0xa0
       do_syscall_64+0x39/0xb0
       entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of: &dev->master_mutex --> &client->modeset_mutex --> &dev->mode_config.mutex
 Possible unsafe locking scenario:
       CPU0                    CPU1
       ----                    ----
  lock(&dev->mode_config.mutex);
                               lock(&client->modeset_mutex);
                               lock(&dev->mode_config.mutex);
  lock(&dev->master_mutex);
*** DEADLOCK ***
1 lock held by kms_frontbuffer/1087:
 #0: ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
stack backtrace:
CPU: 7 PID: 1087 Comm: kms_frontbuffer Not tainted 5.13.0-rc7-CI-CI_DRM_10254+ #1
Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP TLC, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
Call Trace:
 dump_stack+0x7f/0xad
 check_noncircular+0x12e/0x150
 __lock_acquire+0x151e/0x2590
 lock_acquire+0xd1/0x3d0
 __mutex_lock+0xab/0x970
 drm_is_current_master+0x1b/0x40
 drm_mode_getconnector+0x37e/0x4a0
 drm_ioctl_kernel+0xa8/0xf0
 drm_ioctl+0x1e8/0x390
 __x64_sys_ioctl+0x6a/0xa0
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Note that this broke the intel-gfx CI pretty much across the board
because it has to reboot machines after it hits a lockdep splat.

Testcase: igt/debugfs_test/read_all_entries
Acked-by: Petri Latvala <[email protected]>
Fixes: 1815d9c ("drm: add a locked version of drm_is_current_master")
Cc: Desmond Cheong Zhi Xi <[email protected]>
Cc: Emil Velikov <[email protected]>
Cc: [email protected]
Signed-off-by: Daniel Vetter <[email protected]>
Cc: Maarten Lankhorst <[email protected]>
Cc: Maxime Ripard <[email protected]>
Cc: Thomas Zimmermann <[email protected]>
Cc: David Airlie <[email protected]>
Cc: Daniel Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant