From: Luis Henriques <luis.henriques@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>,
Mike Turquette <mturquette@linaro.org>,
Luis Henriques <luis.henriques@canonical.com>
Subject: [PATCH 01/50] clk: remove notifier from list before freeing it
Date: Tue, 2 Jul 2013 12:06:49 +0100 [thread overview]
Message-ID: <1372763258-20664-2-git-send-email-luis.henriques@canonical.com> (raw)
In-Reply-To: <1372763258-20664-1-git-send-email-luis.henriques@canonical.com>
3.5.7.16 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Lai Jiangshan <laijs@cn.fujitsu.com>
commit 72b5322f11ff0abf6a52b3007486656578d2c982 upstream.
The @cn is stay in @clk_notifier_list after it is freed, it cause
memory corruption.
Example, if @clk is registered(first), unregistered(first),
registered(second), unregistered(second).
The freed @cn will be used when @clk is registered(second),
and the bug will be happened when @clk is unregistered(second):
[ 517.040000] clk_notif_dbg clk_notif_dbg.1: clk_notifier_unregister()
[ 517.040000] Unable to handle kernel paging request at virtual address 00df3008
[ 517.050000] pgd = ed858000
[ 517.050000] [00df3008] *pgd=00000000
[ 517.060000] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[ 517.060000] Modules linked in: clk_notif_dbg(O-) [last unloaded: clk_notif_dbg]
[ 517.060000] CPU: 1 PID: 499 Comm: modprobe Tainted: G O 3.10.0-rc3-00119-ga93cb29-dirty #85
[ 517.060000] task: ee1e0180 ti: ee3e6000 task.ti: ee3e6000
[ 517.060000] PC is at srcu_readers_seq_idx+0x48/0x84
[ 517.060000] LR is at srcu_readers_seq_idx+0x60/0x84
[ 517.060000] pc : [<c0052720>] lr : [<c0052738>] psr: 80070013
[ 517.060000] sp : ee3e7d48 ip : 00000000 fp : ee3e7d6c
[ 517.060000] r10: 00000000 r9 : ee3e6000 r8 : 00000000
[ 517.060000] r7 : ed84fe4c r6 : c068ec90 r5 : c068e430 r4 : 00000000
[ 517.060000] r3 : 00df3000 r2 : 00000000 r1 : 00000002 r0 : 00000000
[ 517.060000] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 517.060000] Control: 18c5387d Table: 2d85804a DAC: 00000015
[ 517.060000] Process modprobe (pid: 499, stack limit = 0xee3e6238)
[ 517.060000] Stack: (0xee3e7d48 to 0xee3e8000)
....
[ 517.060000] [<c0052720>] (srcu_readers_seq_idx+0x48/0x84) from [<c0052790>] (try_check_zero+0x34/0xfc)
[ 517.060000] [<c0052790>] (try_check_zero+0x34/0xfc) from [<c00528b0>] (srcu_advance_batches+0x58/0x114)
[ 517.060000] [<c00528b0>] (srcu_advance_batches+0x58/0x114) from [<c0052c30>] (__synchronize_srcu+0x114/0x1ac)
[ 517.060000] [<c0052c30>] (__synchronize_srcu+0x114/0x1ac) from [<c0052d14>] (synchronize_srcu+0x2c/0x34)
[ 517.060000] [<c0052d14>] (synchronize_srcu+0x2c/0x34) from [<c0053a08>] (srcu_notifier_chain_unregister+0x68/0x74)
[ 517.060000] [<c0053a08>] (srcu_notifier_chain_unregister+0x68/0x74) from [<c0375a78>] (clk_notifier_unregister+0x7c/0xc0)
[ 517.060000] [<c0375a78>] (clk_notifier_unregister+0x7c/0xc0) from [<bf008034>] (clk_notif_dbg_remove+0x34/0x9c [clk_notif_dbg])
[ 517.060000] [<bf008034>] (clk_notif_dbg_remove+0x34/0x9c [clk_notif_dbg]) from [<c02bb974>] (platform_drv_remove+0x24/0x28)
[ 517.060000] [<c02bb974>] (platform_drv_remove+0x24/0x28) from [<c02b9bf8>] (__device_release_driver+0x8c/0xd4)
[ 517.060000] [<c02b9bf8>] (__device_release_driver+0x8c/0xd4) from [<c02ba680>] (driver_detach+0x9c/0xc4)
[ 517.060000] [<c02ba680>] (driver_detach+0x9c/0xc4) from [<c02b99c4>] (bus_remove_driver+0xcc/0xfc)
[ 517.060000] [<c02b99c4>] (bus_remove_driver+0xcc/0xfc) from [<c02bace4>] (driver_unregister+0x54/0x78)
[ 517.060000] [<c02bace4>] (driver_unregister+0x54/0x78) from [<c02bbb44>] (platform_driver_unregister+0x1c/0x20)
[ 517.060000] [<c02bbb44>] (platform_driver_unregister+0x1c/0x20) from [<bf0081f8>] (clk_notif_dbg_driver_exit+0x14/0x1c [clk_notif_dbg])
[ 517.060000] [<bf0081f8>] (clk_notif_dbg_driver_exit+0x14/0x1c [clk_notif_dbg]) from [<c00835e4>] (SyS_delete_module+0x200/0x28c)
[ 517.060000] [<c00835e4>] (SyS_delete_module+0x200/0x28c) from [<c000edc0>] (ret_fast_syscall+0x0/0x48)
[ 517.060000] Code: e5973004 e7911102 e0833001 e2881002 (e7933101)
Reported-by: Sören Brinkmann <soren.brinkmann@xilinx.com>
Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Tested-by: Sören Brinkmann <soren.brinkmann@xilinx.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
[mturquette@linaro.org: shortened $SUBJECT]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/clk/clk.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 9a1eb0c..10fdb69 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1538,6 +1538,7 @@ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
/* XXX the notifier code should handle this better */
if (!cn->notifier_head.head) {
srcu_cleanup_notifier_head(&cn->notifier_head);
+ list_del(&cn->node);
kfree(cn);
}
--
1.8.1.2
next prev parent reply other threads:[~2013-07-02 11:20 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-02 11:06 [ 3.5.y.z extended stable ] Linux 3.5.7.16 stable review Luis Henriques
2013-07-02 11:06 ` Luis Henriques [this message]
2013-07-02 11:06 ` [PATCH 02/50] ALSA: usb-audio: work around Android accessory firmware bug Luis Henriques
2013-07-02 11:06 ` [PATCH 03/50] ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam c310 Luis Henriques
2013-07-02 11:06 ` [PATCH 04/50] ncpfs: fix rmdir returns Device or resource busy Luis Henriques
2013-07-02 11:06 ` [PATCH 05/50] tcp: fix tcp_md5_hash_skb_data() Luis Henriques
2013-07-02 11:06 ` [PATCH 06/50] gianfar: add missing iounmap() on error in gianfar_ptp_probe() Luis Henriques
2013-07-02 11:06 ` [PATCH 07/50] ipv6: fix possible crashes in ip6_cork_release() Luis Henriques
2013-07-02 11:06 ` [PATCH 08/50] netlabel: improve domain mapping validation Luis Henriques
2013-07-02 11:06 ` [PATCH 09/50] r8169: fix 8168evl frame padding Luis Henriques
2013-07-02 11:06 ` [PATCH 10/50] r8169: fix offloaded tx checksum for small packets Luis Henriques
2013-07-02 11:06 ` [PATCH 11/50] 8139cp: reset BQL when ring tx ring cleared Luis Henriques
2013-07-02 11:07 ` [PATCH 12/50] tcp: bug fix in proportional rate reduction Luis Henriques
2013-07-02 11:07 ` [PATCH 13/50] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg Luis Henriques
2013-07-02 11:07 ` [PATCH 14/50] net: Unbreak compat_sys_{send,recv}msg Luis Henriques
2013-07-02 11:07 ` [PATCH 15/50] tcp: xps: fix reordering issues Luis Henriques
2013-07-02 11:07 ` [PATCH 16/50] ip_tunnel: fix kernel panic with icmp_dest_unreach Luis Henriques
2013-07-02 11:07 ` [PATCH 17/50] net: force a reload of first item in hlist_nulls_for_each_entry_rcu Luis Henriques
2013-07-02 11:07 ` [PATCH 18/50] ipv6: assign rt6_info to inet6_ifaddr in init_loopback Luis Henriques
2013-07-02 11:07 ` [PATCH 19/50] net: sctp: fix NULL pointer dereference in socket destruction Luis Henriques
2013-07-02 11:07 ` [PATCH 20/50] team: check return value of team_get_port_by_index_rcu() for NULL Luis Henriques
2013-07-02 11:07 ` [PATCH 21/50] packet: packet_getname_spkt: make sure string is always 0-terminated Luis Henriques
2013-07-02 11:07 ` [PATCH 22/50] l2tp: Fix PPP header erasure and memory leak Luis Henriques
2013-07-02 11:07 ` [PATCH 23/50] l2tp: Fix sendmsg() return value Luis Henriques
2013-07-02 11:07 ` [PATCH 24/50] bonding: rlb mode of bond should not alter ARP originating via bridge Luis Henriques
2013-07-02 11:07 ` [PATCH 25/50] tilepro: work around module link error with gcc 4.7 Luis Henriques
2013-07-02 11:07 ` [PATCH 26/50] Input: cyttsp - fix memcpy size param Luis Henriques
2013-07-02 11:07 ` [PATCH 27/50] target/iscsi: don't corrupt bh_count in iscsit_stop_time2retain_timer() Luis Henriques
2013-07-02 11:07 ` [PATCH 28/50] tcm_qla2xxx: Fix residual for underrun commands that fail Luis Henriques
2013-07-02 11:07 ` [PATCH 29/50] KVM: x86: remove vcpu's CPL check in host-invoked XCR set Luis Henriques
2013-07-02 11:07 ` [PATCH 30/50] x86: fix build error and kconfig for ia32_emulation and binfmt Luis Henriques
2013-07-02 11:07 ` [PATCH 31/50] USB: serial: ti_usb_3410_5052: new device id for Abbot strip port cable Luis Henriques
2013-07-02 11:07 ` [PATCH 32/50] drm/radeon: update lockup tracking when scheduling in empty ring Luis Henriques
2013-07-02 11:07 ` [PATCH 33/50] team: move add to port list before port enablement Luis Henriques
2013-07-02 11:07 ` [PATCH 34/50] net: sh_eth: fix incorrect RX length error if R8A7740 Luis Henriques
2013-07-02 11:07 ` [PATCH 35/50] sctp: fully initialize sctp_outq in sctp_outq_init Luis Henriques
2013-07-02 11:07 ` [PATCH 36/50] ARM: 7755/1: handle user space mapped pages in flush_kernel_dcache_page Luis Henriques
2013-07-02 11:07 ` [PATCH 37/50] iwlwifi: dvm: fix chain noise calibration Luis Henriques
2013-07-02 11:07 ` [PATCH 38/50] Bluetooth: Fix crash in l2cap_build_cmd() with small MTU Luis Henriques
2013-07-02 11:07 ` [PATCH 39/50] hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot() Luis Henriques
2013-07-02 11:07 ` [PATCH 40/50] ARM: 7772/1: Fix missing flush_kernel_dcache_page() for noMMU Luis Henriques
2013-07-02 11:07 ` [PATCH 41/50] net/tg3: Avoid delay during MMIO access Luis Henriques
2013-07-02 11:07 ` [PATCH 42/50] dlci: acquire rtnl_lock before calling __dev_get_by_name() Luis Henriques
2013-07-02 11:07 ` [PATCH 43/50] dlci: validate the net device in dlci_del() Luis Henriques
2013-07-02 11:07 ` [PATCH 44/50] Bluetooth: btmrvl: fix thread stopping race Luis Henriques
2013-07-02 11:07 ` [PATCH 45/50] pch_uart: fix a deadlock when pch_uart as console Luis Henriques
2013-07-02 11:07 ` [PATCH 46/50] perf: Disable monitoring on setuid processes for regular users Luis Henriques
2013-07-02 11:07 ` [PATCH 47/50] UBIFS: prepare to fix a horrid bug Luis Henriques
2013-07-02 11:07 ` [PATCH 48/50] UBIFS: " Luis Henriques
2013-07-02 11:07 ` [PATCH 49/50] perf: Fix perf mmap bugs Luis Henriques
2013-07-02 11:07 ` [PATCH 50/50] perf: Fix mmap() accounting hole Luis Henriques
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1372763258-20664-2-git-send-email-luis.henriques@canonical.com \
--to=luis.henriques@canonical.com \
--cc=kernel-team@lists.ubuntu.com \
--cc=laijs@cn.fujitsu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mturquette@linaro.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®