From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755065AbdCGJYN (ORCPT ); Tue, 7 Mar 2017 04:24:13 -0500 Received: from mail-by2nam03on0061.outbound.protection.outlook.com ([104.47.42.61]:13114 "EHLO NAM03-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754735AbdCGJXP (ORCPT ); Tue, 7 Mar 2017 04:23:15 -0500 Authentication-Results: spf=pass (sender IP is 149.199.60.100) smtp.mailfrom=xilinx.com; roeck-us.net; dkim=none (message not signed) header.d=none;roeck-us.net; dmarc=bestguesspass action=none header.from=xilinx.com; Subject: Re: [PATCH] block: systemace: Fix refcount underflow in error handler To: Guenter Roeck , Michal Simek References: <1488756960-3659-1-git-send-email-linux@roeck-us.net> CC: =?UTF-8?Q?S=c3=b6ren_Brinkmann?= , , From: Michal Simek Message-ID: <17da5bdf-614a-6846-1cb9-94adcf1b2c93@xilinx.com> Date: Tue, 7 Mar 2017 10:22:31 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <1488756960-3659-1-git-send-email-linux@roeck-us.net> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-RCIS-Action: ALLOW X-TM-AS-Product-Ver: IMSS-7.1.0.1224-8.1.0.1062-22926.006 X-TM-AS-User-Approved-Sender: Yes;Yes X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:149.199.60.100;IPV:NLI;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10009020)(979002)(6009001)(7916002)(39840400002)(39860400002)(39410400002)(39850400002)(39450400003)(2980300002)(438002)(199003)(24454002)(189002)(9170700003)(36756003)(64126003)(305945005)(356003)(47776003)(50466002)(23746002)(8936002)(76176999)(50986999)(54356999)(230700001)(38730400002)(6246003)(2906002)(626004)(9786002)(53546006)(189998001)(4326008)(92566002)(8676002)(65956001)(2950100002)(4001350100001)(65806001)(63266004)(5890100001)(81166006)(36386004)(33646002)(31686004)(54906002)(5660300001)(83506001)(106466001)(65826007)(229853002)(575784001)(31696002)(86362001)(77096006)(107986001)(5001870100001)(969003)(989001)(999001)(1009001)(1019001);DIR:OUT;SFP:1101;SCL:1;SRVR:DM2PR02MB1387;H:xsj-pvapsmtpgw02;FPR:;SPF:Pass;MLV:ovrnspm;A:1;MX:1;PTR:unknown-60-100.xilinx.com,xapps1.xilinx.com;LANG:en; X-Microsoft-Exchange-Diagnostics: 1;SN1NAM02FT025;1:TEtwnqENPu03DzK4oeco3a/wEzRU1AF4tOh/OCzfAR+mFNB04Z5iXEs3S2iNCpFb6fh2aEr9YhqSLgBQY1ytzEINgK3EoivDHzXbzTmp7wQoaOtieKA1wc6s59zZ3rqwHpvGVKGnTTd0sgBgwZtw53e0VY3sWmjvX1oHM+KdlfQtYySts0Li0saJpYj9Ix9WGYKwR/y5ru1WgKqLr2niorqPR3DJEdlE54z1aKGfOx76aa9bFg8WDukvI1vO6vHf0wRHLaUWbiNxgVxza6LHPdObW2dYn/llRqGPgKRvgXyhkY2jv60xQCfBLk0kHsV+Xjrf8pBYh8NE0hL8N5bSCWx76l82P3q34h7bL2zK002fJBcM3mnvffrhhjBej7u/pC6x0NVpDSF3yjplG6WYuKQJjUOz1R3QYH27J6VUyIcHJ8jjaWCY8vblY7nbA+XzwHuv76JzmCUu91y7U5Izu00maUySkGAJaZFZxwffipriH8ZXg8ZEv4EgU31YFnYd1yZ/afDygCnhU7c5FDKrBKH1JcsrHonkPYuK/vAdS28= X-MS-Office365-Filtering-Correlation-Id: 05b9156e-883d-4d1f-eeb7-08d4653b81e1 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(8251501002);SRVR:DM2PR02MB1387; X-Microsoft-Exchange-Diagnostics: 1;DM2PR02MB1387;3:jUFLSjIS6vgAwg8BJsjoyOF1SVy2fUmu+yNOrNbDg5n8OKpzlPMG9n5CAczXMv32adyBhL8rDjJjm2hWhb9bN1hxLECXwkHkbUcsjbk3qvmABGggwawXBSrX2nkGice+bI06k25xnIHiS0/cF7GSLRXyyWCl152Q3X10jzmD/J8sgBO/ZIXKf6YGtjKhGWHW1fd3nM0ZZOp1bwmFnXvIJ6qKefHlvZPwAou/vkxJNup7AxTY4QaOPJaBKgusPlyA/e2d5zO6LxWAYapMn4d1NZYEOkVtAVOdA8sBKYfbkNhPBNbWW0MuvEFhx6f50xTpGm+vKn8VT1xczE5m2gj5jMl1DktOMv5cvoCxjfOFRVJEHG+hTGkT+IJmFU48oDMxFLf7IufEBRZU2YwV4hnIXg==;25:fZmEDe/8DFF4v9YVFgOk712qHHALUmkH5aaRkZ6xwktA8kIGgHVBke6H1Eac/e01zip1R3sBqQgE1GFi2EDLyWWKBDaJKc6SgEvhfXQ6m3nCHD7zSvV8QXFjUp/MtIg8z5Hi0no5Krv8MeMkbWw0JslulaXLqHNbW2NF9e47nwLD/KNl9pb/ZvxYNjsynSWafuT+PFkBIkcwbWEXQOJuM14OGaPxIMvU/9KbkixMljywTf0Fqw3LWE/1iwNbldpj8Fn7UXtXg1OuMJpqirHsKFji4Q6gd+Xx8PuVIZDzJ42i7o084Za3bVnJtkECsgf1Kf0p99yhgE6tHr4LYSsZEKwsiBRvx2qpT6d2ELBUb4zkM8DWUz3MGOkpQowQHcZv8swQhW7d0F8DwEoCrfHX4xg4BfLTWzH+yCrz3hjkXFrcZZ+FVfA3qmT2InTk9kS9akt+I/YeHufzAM0XjUlYuA== X-Microsoft-Exchange-Diagnostics: 1;DM2PR02MB1387;31:ecn9ydSwtuf4Urn06rJw7fv1oEuciBQXSoObNC4WIF3V+npwgxWu96yXol6NCLHobxISou4zn7rHqJFzMv4NjhSiFDaIOTSChtxTuWRD/kz29WCYTXfSfr0XCXregEZ5PNuXrPEja0NtPwK1n0Rljwt1IxPxUmBSWiT1cxQPSTZ0fovDgdPIE6YwfwpwKCYVZ8tl3wOx/qLB7iNg/g2bLeKmm1gig7YM3lObpEjEyhnBMbYWayo1myTqAjHv2ls2gYvcP3LQpbfYUgPqOZ2i2EUn12IXABYQ4fENtGyibbs=;20:bYQ0mRHTGl+ehP4E56y95vs4yrfBmoFjQt3J1mPOPi1pfKmz5CPUO8e4Y467q2BmE4ec6ls2vba9ikb8d0FBK55RlusCHYTG0RQN0Y8a9SaUMfICWoSqJWV+ZJhOnWym4eK9BS3BaON4g3NwHxLsDc/sTkWeo37Ufv2iFHBQQZ/wyV+1yHtp656U51F3bUcY62m4Jv2cTWCYZxCSjAYAl5K5PLzk+I4lzwnyM9Sgp9KA6ofBkoqILPUqaVv0+U1TVGfRAYilE7gmeeicpR1ph3y4Hzv8rCz0AmP6YRSr3kuwIz/qm/IOG9AxRcNQbWrhGLEqQ/5hZRI7ZaOuBkr95JCOQHAtuzn27Edk0R0NzUw1f+NqVsV14S6Cy2pp7/T1CA7EdSFoFyKmzPEGwljokhs4vkRIcNiX2VQrxbuWHVtSeyBfDPsbrtphioqXA4ebnlXasWaqLpnNSAPw+1B05IKQBeKBE/gaKiszErjDfyLTdKu3QvRzS3WvAV3SE7S1 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192813158149592); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(13018025)(13024025)(13023025)(13017025)(13015025)(8121501046)(5005006)(10201501046)(3002001)(6055026)(6041248)(20161123564025)(20161123562025)(20161123558025)(20161123560025)(20161123555025)(6072148);SRVR:DM2PR02MB1387;BCL:0;PCL:0;RULEID:;SRVR:DM2PR02MB1387; X-Microsoft-Exchange-Diagnostics: 1;DM2PR02MB1387;4:u2aSlXs9wGrCfzuCH6jqzgvowfjSbvAe9NjC+qPY7F0Lf2f6Iy/y3lo0qZ68sDFoZxBub0dfhgSeR5dvA6VYQ5cE+37bBXhDLpjkkajj/2bIMRo0Lt7EAfGDTcBp++O5JB31lQzylhe0YGKuCAeFiJmhKQiLFbmIOGd0PMv/jUkzm25CFRUhYBgdomUZQ5CxYZfKZwD6JJyYN1qjigMQh160TNOAxXiQnuIoFI+I0mqdLY2E7jj6gQGb3FdnEhiRuE9zOSBno40r3xrzrR6hxS3P1Qj9Co3u2uAFmaR5BINLeFv8efwUjHd01bQPQgMebaJysE6ZPU/TXJjMM1sUihBfMZzPo10A67LVxSmLR4b3M1xOgKV8pdYDmLnCIZJRXW8FY8kw9NlkJzppbD7yCvbq7OvQj6gAXbr4/kjADd8N2YLFqjB2J7ep5fKdatOKVQnMB71ia+FnN+tXeuAEomj0+9fEFclcFPqke5Jz+MLmCtjjbci8Ou46X1hZju1OjPbu9UF4qw04i2SXbsNbP9ayvUSsurrhUemlC0foCCqU7qr/lq1HJ9n0xo9EpE+T50z9Mz08i3pr1xoGq3zZR//HcW0qmsgFXEsGiplj0iDL2ImfLiymt4BE498EcofhEC/xmi86a+/ov6KoQoFx1auMUsMr1pFWr7/3OKMX3wjCmOfKDVMSCLZB+SPn4lyStvAxoj4vh5PZ62drhZu9e14HvWDlHuMKml+SxPUX+acuRCE9PePCUSXr13E+gkB1qujaBvdPwGHhWuqKYdhCUg== X-Forefront-PRVS: 0239D46DB6 X-Microsoft-Exchange-Diagnostics: =?Windows-1252?Q?1;DM2PR02MB1387;23:tJvkquEe+a4v2O3aWbz8lzcIeEAwoJBiAA2Rs?= =?Windows-1252?Q?UFMI9TIxTp7dcjMmY0dZMnq66EJJ5ZEOxT0WSLh1E7s6LXrDAy6y9Tyw?= =?Windows-1252?Q?70rbTalaZ/K5lJ4FJQUNIi4NqgV+XrPWzKuczHcGfOIZbVQpNR73OMaA?= =?Windows-1252?Q?K/fwixBVcilnKEguvB20BgabPFtjjLk0dQfr4oqSekd6P/FdkSG1HLdF?= =?Windows-1252?Q?kSPShdOAew/J5+SJeA0FHfRwY/tmMPunsxoZezdk34ahszhN1AM5y2Kt?= =?Windows-1252?Q?qSp+L8KzNGYD/H1djRRbCT6tsUs4JaEyuojDGjcscOU36KTGk2HdML4B?= =?Windows-1252?Q?k+j77SWKwtW8xTyvBBnGmke3g2rVxqhXig03DLT4esQtDa/MQoohF8Za?= =?Windows-1252?Q?ewsZqwPkVKFFwwqbsjFkp70/DwVkodEMdOEGUOPoO86QMzsu4gEWxD6/?= =?Windows-1252?Q?qtKeeYb3v+RWpS3dZtizh2zGoHqyocIsKh0SZhZWvHxFyYn1TnViRM24?= =?Windows-1252?Q?aKptGFzybBs8/NNpi6DZ7sUvjJC4iSua1/fl5rVYpd0l7lBV11YhcF/B?= =?Windows-1252?Q?nQT9N0HrClJ4l/2MlN3rVrvUiZSU9eBg40syoKBkipNInnATX7ePb/m7?= =?Windows-1252?Q?plrYfLkTo2ow6hzZGDRbSgdKQuCz1y8++cU76imF6o1fuh5EgGbL6WEg?= =?Windows-1252?Q?dJLrlIqTXESvmTTOpX5lb+tFTBurXR+g+UHDGXb2/mH4rDoNpnDUUwr2?= =?Windows-1252?Q?mQ1OO1cpIu+8pnGGGKBNpNE+IGcPaKu+X7x0l/jdl27LbXuL1LQ0uzZI?= =?Windows-1252?Q?KYZz0v/RE6bT2N8HLBKqLt6hiGGyPnwM2NhvXb3yLBatOU4j7q3MfaAs?= =?Windows-1252?Q?uCyGu1zfyaTeSUOmxs/q5KURN/3PHURyrAXrDuhFUOZg+kZRrbo1ATq+?= =?Windows-1252?Q?kP4QcBFFB/F/v2OloTPt17LqaimiI1x7dGpRwtDEKrIx96SWoOjwbDp2?= =?Windows-1252?Q?pwha/LsD5PXT3XxjWsrGY1OtkYcv2fa9EmnqS+7UCKNpaHGH0aUimxmi?= =?Windows-1252?Q?FUpHIMXkq6DIXqXmMaUIAhlv9/r1JtwK7X4kB+5m6HVA4MNjzm6vuOYt?= =?Windows-1252?Q?ca2Fr1t/80eATkDKrOfL3/Takywuxn85PORfCyN9lDSupS+vFlvm3Tyb?= =?Windows-1252?Q?Civi0a4Z89WlyMOsRKJMykI3gvbP/8OwpihESp+1jmO0E9JuaUOmQsvI?= =?Windows-1252?Q?OhwbCaeRAUra9YZP4LTSFsVu4H1e/GWOrCxxT5WICdTKdjdyPTbUC1Se?= =?Windows-1252?Q?WL1tAkRXPFg/YT4QOWSOel+x+ktjYfWlix5o2GTegM3OFU/zD1Uvha3A?= =?Windows-1252?Q?KQpWvLE47/+4Ot3+waxGCDu9fv2dzbHO055GLg9tlF1xNGU4a14/pu23?= =?Windows-1252?Q?HFX3CLqfntjhS/CDaWnfq24b7RB6MT+ZZCKN0ZAk1CX+8BXmSgU4c4BE?= =?Windows-1252?Q?/RqG+e96+WcyFwOh7PJJpsu2h9O6Rl0OqyI2D7BbHeu1Qm0iJKVNmDkH?= =?Windows-1252?Q?7P3EfSNRb5Cn9U2tXWNrig8+Vjv3KAKztnLKnLYuPV4BTwmXMVmPUYFr?= =?Windows-1252?B?dz09?= X-Microsoft-Exchange-Diagnostics: 1;DM2PR02MB1387;6:SmyimxYGZ+Ef6UlJTrcfuvVRNicZL/nhwv/sYWKBr/Xkk8UNM5hGYhCvfuspHD2LKmV2hugd9yFQOzseIzOLQKRbmXGpl9xPXsBMz9cEkLO4zfhtHV2BJWLdBvzNjA9ms5ELiBbbm1jn/5JMghtLDO8utSwIyqcgr7dAiqN6vv81TR90zPbKEYEs5q72s382rkPVYDF7VejJSurKVDgolLAYKqfziMRxjvZ7MflZvVxF0GV06CaZUIVnJFWl1mW62hm0rEHhgaPOK37j0WUd+B3gdOTjcYJqVfBJkA1y6lKeqFv8RYEgIVpToLqLeLZI90mLHE9cudhnY/N0O+xyptufm9oRYamzfkG82IMo2tQ/yV9L4qOLztN/0L5riferDE+GZY/7deCVxixGArPdE7aeCNjwwak9FQ2c/NQcWxw=;5:xzDm/JrJ9a36uDAljBvbq7tT9ax9cDy5mh2eCB2oC33a/vD5TxZW+43jPnY/pBjyVv6QW04+frhHXgM7LgWPriVT+cAxSX8jqf/YW/fYkAx82Wzy9ODTYptJWym91ScLifqRTTgnrXxQSWyaf7XG7w==;24:Wqpg+WgXGcQhAIHF5P7K7S5AW2FirsGEWBUTq6OGJzt7wHXzYoNUSmO/BeooL+GBKgh+MOhuxslKfcGbrBwZXnGWH55CG1IUpD3kKwj8qa4= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DM2PR02MB1387;7:hhOzz3K2ix+aUe+oX6rAPU9DJA8aTaoXb/TVmeJ95p9Q3gV1IDdYJ5sbkoOLL5RBviErlBYZfNQjGBxJ07EhE5iGEswZyg/fgHrZKW8AufAq5raDzhEAlB1G4A2rO/9icAMZP75DkwBDo5U0lC8EfyRBAKFRa3xstu/KMqNZOm9yTyNAcroORPuxWSq652Zg75CB9y7CX7CSf8I6K4SRmVkWskuW9nAhKOld8m8/cLAHQBTT7SKN+yX38eMMGXU95al191cC9BMB+4XoksYlHiz7ELcyr5tgmQsDHEAV6i9vad7ULB5RheVU506uErdmXhVbGlFayQQLkdQD1pSaiQ== X-OriginatorOrg: xilinx.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Mar 2017 09:22:42.0438 (UTC) X-MS-Exchange-CrossTenant-Id: 657af505-d5df-48d0-8300-c31994686c5c X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=657af505-d5df-48d0-8300-c31994686c5c;Ip=[149.199.60.100];Helo=[xsj-pvapsmtpgw02] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR02MB1387 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 6.3.2017 00:36, Guenter Roeck wrote: > Since commit 29dee3c03abc ("locking/refcounts: Out-of-line everything"), > the following runtime warning is seen if xsysace fails to initialize. > The commit only exposes the problem. > > refcount_t: underflow; use-after-free. > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 1 at lib/refcount.c:128 refcount_sub_and_test+0x90/0xd0 > Modules linked in: > CPU: 0 PID: 1 Comm: swapper Not tainted 4.11.0-rc1+ #1 > task: cf81d5a0 task.stack: cf81e000 > NIP: c02104d0 LR: c02104d0 CTR: c0279d90 > REGS: cf81fc80 TRAP: 0700 Not tainted (4.11.0-rc1+) > MSR: 00029000 > CR: 24000022 XER: 00000000 > > GPR00: c02104d0 cf81fd30 cf81d5a0 00000026 00000000 00000000 c027a7f0 00000000 > GPR08: c05412dc 00000800 00000000 00000000 24000024 00000000 c0001ad0 00000000 > GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 c054b3c0 c0550000 > GPR24: 00000000 00000001 cf95a010 00000015 00000000 00000000 cfb2b2c0 cfb2b0e8 > NIP [c02104d0] refcount_sub_and_test+0x90/0xd0 > LR [c02104d0] refcount_sub_and_test+0x90/0xd0 > Call Trace: > [cf81fd30] [c02104d0] refcount_sub_and_test+0x90/0xd0 (unreliable) > [cf81fd40] [c01f68c4] kobject_put+0x34/0x90 > [cf81fd50] [c01cef64] blk_cleanup_queue+0x164/0x1e0 > [cf81fd60] [c02acab0] ace_probe+0x4c0/0x510 > [cf81fda0] [c0293b64] platform_drv_probe+0x44/0xc0 > [cf81fdc0] [c0291974] driver_probe_device+0x234/0x340 > [cf81fdf0] [c0291b4c] __driver_attach+0xcc/0xd0 > [cf81fe10] [c028f4d8] bus_for_each_dev+0x68/0xc0 > [cf81fe40] [c0290d18] bus_add_driver+0x208/0x280 > [cf81fe60] [c0292678] driver_register+0x88/0x140 > [cf81fe70] [c050ce24] ace_init+0x48/0xa4 > [cf81fe90] [c0001350] do_one_initcall+0x40/0x180 > [cf81fef0] [c04f3ae0] kernel_init_freeable+0x134/0x1d0 > [cf81ff30] [c0001ae4] kernel_init+0x14/0x110 > [cf81ff40] [c000c3d0] ret_from_kernel_thread+0x5c/0x64 > > Debugging shows that blk_put_queue() is called twice during error > handling, once from disk_release() (called from put_disk) and once > from blk_cleanup_queue(). disk_release() only calls blk_put_queue() > if the queue pointer is initialized, so moving the initialization of > gd->queue avoids the problem. > > Signed-off-by: Guenter Roeck > --- > drivers/block/xsysace.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c > index 757dce2147e0..a22b38968930 100644 > --- a/drivers/block/xsysace.c > +++ b/drivers/block/xsysace.c > @@ -1004,7 +1004,6 @@ static int ace_setup(struct ace_device *ace) > ace->gd->major = ace_major; > ace->gd->first_minor = ace->id * ACE_NUM_MINORS; > ace->gd->fops = &ace_fops; > - ace->gd->queue = ace->queue; > ace->gd->private_data = ace; > snprintf(ace->gd->disk_name, 32, "xs%c", ace->id + 'a'); > > @@ -1032,6 +1031,8 @@ static int ace_setup(struct ace_device *ace) > ace_out(ace, ACE_CTRL, ACE_CTRL_FORCECFGMODE | > ACE_CTRL_DATABUFRDYIRQ | ACE_CTRL_ERRORIRQ); > > + ace->gd->queue = ace->queue; > + > /* Now we can hook up the irq handler */ > if (ace->irq) { > rc = request_irq(ace->irq, ace_interrupt, 0, "systemace", ace); > Acked-by: Michal Simek Thanks, Michal