1. 02 3月, 2017 1 次提交
  2. 15 1月, 2017 1 次提交
    • Y
      locktorture: Fix potential memory leak with rw lock test · f4dbba59
      Yang Shi 提交于
      When running locktorture module with the below commands with kmemleak enabled:
      
      $ modprobe locktorture torture_type=rw_lock_irq
      $ rmmod locktorture
      
      The below kmemleak got caught:
      
      root@10:~# echo scan > /sys/kernel/debug/kmemleak
      [  323.197029] kmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
      root@10:~# cat /sys/kernel/debug/kmemleak
      unreferenced object 0xffffffc07592d500 (size 128):
        comm "modprobe", pid 368, jiffies 4294924118 (age 205.824s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 c3 7b 02 00 00 00 00 00  .........{......
          00 00 00 00 00 00 00 00 d7 9b 02 00 00 00 00 00  ................
        backtrace:
          [<ffffff80081e5a88>] create_object+0x110/0x288
          [<ffffff80086c6078>] kmemleak_alloc+0x58/0xa0
          [<ffffff80081d5acc>] __kmalloc+0x234/0x318
          [<ffffff80006fa130>] 0xffffff80006fa130
          [<ffffff8008083ae4>] do_one_initcall+0x44/0x138
          [<ffffff800817e28c>] do_init_module+0x68/0x1cc
          [<ffffff800811c848>] load_module+0x1a68/0x22e0
          [<ffffff800811d340>] SyS_finit_module+0xe0/0xf0
          [<ffffff80080836f0>] el0_svc_naked+0x24/0x28
          [<ffffffffffffffff>] 0xffffffffffffffff
      unreferenced object 0xffffffc07592d480 (size 128):
        comm "modprobe", pid 368, jiffies 4294924118 (age 205.824s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 3b 6f 01 00 00 00 00 00  ........;o......
          00 00 00 00 00 00 00 00 23 6a 01 00 00 00 00 00  ........#j......
        backtrace:
          [<ffffff80081e5a88>] create_object+0x110/0x288
          [<ffffff80086c6078>] kmemleak_alloc+0x58/0xa0
          [<ffffff80081d5acc>] __kmalloc+0x234/0x318
          [<ffffff80006fa22c>] 0xffffff80006fa22c
          [<ffffff8008083ae4>] do_one_initcall+0x44/0x138
          [<ffffff800817e28c>] do_init_module+0x68/0x1cc
          [<ffffff800811c848>] load_module+0x1a68/0x22e0
          [<ffffff800811d340>] SyS_finit_module+0xe0/0xf0
          [<ffffff80080836f0>] el0_svc_naked+0x24/0x28
          [<ffffffffffffffff>] 0xffffffffffffffff
      
      It is because cxt.lwsa and cxt.lrsa don't get freed in module_exit, so free
      them in lock_torture_cleanup() and free writer_tasks if reader_tasks is
      failed at memory allocation.
      Signed-off-by: NYang Shi <yang.shi@linaro.org>
      Signed-off-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Reviewed-by: NJosh Triplett <josh@joshtriplett.org>
      f4dbba59
  3. 14 1月, 2017 1 次提交
  4. 28 4月, 2016 1 次提交
  5. 13 4月, 2016 2 次提交
    • D
      locking/locktorture: Fix NULL pointer dereference for cleanup paths · c1c33b92
      Davidlohr Bueso 提交于
      It has been found that paths that invoke cleanups through
      lock_torture_cleanup() can trigger NULL pointer dereferencing
      bugs during the statistics printing phase. This is mainly
      because we should not be calling into statistics before we are
      sure things have been set up correctly.
      
      Specifically, early checks (and the need for handling this in
      the cleanup call) only include parameter checks and basic
      statistics allocation. Once we start write/read kthreads
      we then consider the test as started. As such, update the function
      in question to check for cxt.lwsa writer stats, if not set,
      we either have a bogus parameter or -ENOMEM situation and
      therefore only need to deal with general torture calls.
      Reported-and-tested-by: NKefeng Wang <wangkefeng.wang@huawei.com>
      Signed-off-by: NDavidlohr Bueso <dbueso@suse.de>
      Signed-off-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Davidlohr Bueso <dave@stgolabs.net>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: bobby.prani@gmail.com
      Cc: dhowells@redhat.com
      Cc: dipankar@in.ibm.com
      Cc: dvhart@linux.intel.com
      Cc: edumazet@google.com
      Cc: fweisbec@gmail.com
      Cc: jiangshanlai@gmail.com
      Cc: josh@joshtriplett.org
      Cc: mathieu.desnoyers@efficios.com
      Cc: oleg@redhat.com
      Cc: rostedt@goodmis.org
      Link: http://lkml.kernel.org/r/1460476038-27060-2-git-send-email-paulmck@linux.vnet.ibm.com
      [ Improved the changelog. ]
      Signed-off-by: NIngo Molnar <mingo@kernel.org>
      c1c33b92
    • D
      locking/locktorture: Fix deboosting NULL pointer dereference · 1f190931
      Davidlohr Bueso 提交于
      For the case of rtmutex torturing we will randomly call into the
      boost() handler, including upon module exiting when the tasks are
      deboosted before stopping. In such cases the task may or may not have
      already been boosted, and therefore the NULL being explicitly passed
      can occur anywhere. Currently we only assume that the task will is
      at a higher prio, and in consequence, dereference a NULL pointer.
      
      This patch fixes the case of a rmmod locktorture exploding while
      pounding on the rtmutex lock (partial trace):
      
       task: ffff88081026cf80 ti: ffff880816120000 task.ti: ffff880816120000
       RSP: 0018:ffff880816123eb0  EFLAGS: 00010206
       RAX: ffff88081026cf80 RBX: ffff880816bfa630 RCX: 0000000000160d1b
       RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000
       RBP: ffff88081026cf80 R08: 000000000000001f R09: ffff88017c20ca80
       R10: 0000000000000000 R11: 000000000048c316 R12: ffffffffa05d1840
       R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
       FS:  0000000000000000(0000) GS:ffff88203f880000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000008 CR3: 0000000001c0a000 CR4: 00000000000406e0
       Stack:
        ffffffffa05d141d ffff880816bfa630 ffffffffa05d1922 ffff88081e70c2c0
        ffff880816bfa630 ffffffff81095fed 0000000000000000 ffffffff8107bf60
        ffff880816bfa630 ffffffff00000000 ffff880800000000 ffff880816123f08
       Call Trace:
        [<ffffffff81095fed>] kthread+0xbd/0xe0
        [<ffffffff815cf40f>] ret_from_fork+0x3f/0x70
      
      This patch ensures that if the random state pointer is not NULL and current
      is not boosted, then do nothing.
      
       RIP: 0010:[<ffffffffa05c6185>]  [<ffffffffa05c6185>] torture_random+0x5/0x60 [torture]
        [<ffffffffa05d141d>] torture_rtmutex_boost+0x1d/0x90 [locktorture]
        [<ffffffffa05d1922>] lock_torture_writer+0xe2/0x170 [locktorture]
      Signed-off-by: NDavidlohr Bueso <dbueso@suse.de>
      Signed-off-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Davidlohr Bueso <dave@stgolabs.net>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: bobby.prani@gmail.com
      Cc: dhowells@redhat.com
      Cc: dipankar@in.ibm.com
      Cc: dvhart@linux.intel.com
      Cc: edumazet@google.com
      Cc: fweisbec@gmail.com
      Cc: jiangshanlai@gmail.com
      Cc: josh@joshtriplett.org
      Cc: mathieu.desnoyers@efficios.com
      Cc: oleg@redhat.com
      Cc: rostedt@goodmis.org
      Link: http://lkml.kernel.org/r/1460476038-27060-1-git-send-email-paulmck@linux.vnet.ibm.comSigned-off-by: NIngo Molnar <mingo@kernel.org>
      1f190931
  6. 07 10月, 2015 3 次提交
  7. 28 5月, 2015 2 次提交
  8. 30 9月, 2014 4 次提交
  9. 17 9月, 2014 8 次提交
  10. 15 5月, 2014 2 次提交
  11. 14 5月, 2014 1 次提交
  12. 18 4月, 2014 1 次提交
  13. 24 2月, 2014 2 次提交