1. 01 6月, 2015 3 次提交
    • V
      Drivers: hv: balloon: check if ha_region_mutex was acquired in MEM_CANCEL_ONLINE case · 4e4bd36f
      Vitaly Kuznetsov 提交于
      Memory notifiers are being executed in a sequential order and when one of
      them fails returning something different from NOTIFY_OK the remainder of
      the notification chain is not being executed. When a memory block is being
      onlined in online_pages() we do memory_notify(MEM_GOING_ONLINE, ) and if
      one of the notifiers in the chain fails we end up doing
      memory_notify(MEM_CANCEL_ONLINE, ) so it is possible for a notifier to see
      MEM_CANCEL_ONLINE without seeing the corresponding MEM_GOING_ONLINE event.
      E.g. when CONFIG_KASAN is enabled the kasan_mem_notifier() is being used
      to prevent memory hotplug, it returns NOTIFY_BAD for all MEM_GOING_ONLINE
      events. As kasan_mem_notifier() comes before the hv_memory_notifier() in
      the notification chain we don't see the MEM_GOING_ONLINE event and we do
      not take the ha_region_mutex. We, however, see the MEM_CANCEL_ONLINE event
      and unconditionally try to release the lock, the following is observed:
      
      [  110.850927] =====================================
      [  110.850927] [ BUG: bad unlock balance detected! ]
      [  110.850927] 4.1.0-rc3_bugxxxxxxx_test_xxxx #595 Not tainted
      [  110.850927] -------------------------------------
      [  110.850927] systemd-udevd/920 is trying to release lock
      (&dm_device.ha_region_mutex) at:
      [  110.850927] [<ffffffff81acda0e>] mutex_unlock+0xe/0x10
      [  110.850927] but there are no more locks to release!
      
      At the same time we can have the ha_region_mutex taken when we get the
      MEM_CANCEL_ONLINE event in case one of the memory notifiers after the
      hv_memory_notifier() in the notification chain failed so we need to add
      the mutex_is_locked() check. In case of MEM_ONLINE we are always supposed
      to have the mutex locked.
      Signed-off-by: NVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4e4bd36f
    • K
      6c4e5f9c
    • V
      char: misc: restore MISC_DYNAMIC_MINOR on device_create() failure · b575f712
      Vladimir Zapolskiy 提交于
      On attempt to register a dynamic minor misc device its minor number is
      updated to a virtual minor number prior to device_create() call,
      however on error path misc->minor == MISC_DYNAMIC_MINOR is not
      restored.
      
      Following the rule of thumb that a function returning an error must
      not change the state of the caller, assign MISC_DYNAMIC_MINOR back.
      
      The problem is met in a sutuation, when subsys_initcall(misc_init) is
      not yet called and misc_class is not created, but misc_register()
      modifies statically defined ".minor = MISC_DYNAMIC_MINOR", therefore
      implicitly changing the client's logic on next attempt (e.g. retrying
      from deferred list) to register a misc device, whose minor number is
      converted from dynamic to some unknown static one.
      Signed-off-by: NVladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b575f712
  2. 31 5月, 2015 1 次提交
  3. 25 5月, 2015 36 次提交