[PATCH stable 6.1 0/2] Mising cache info backports for 6.1

[PATCH stable 6.1 0/2] Mising cache info backports for 6.1

[Florian Fainelli]

Hi Pierre, Greg,

After 22def0b492e683cc5df2a8ef1b94a17be0d50d84 ("arch_topology: Build
cacheinfo from primary CPU") got backported into Linux 6.1.159, I
started seeing on exactly the 3rd system suspend/resume cycle (which
involves CPU hotplug for shutting down secondary cores) the splat below.
Upon closer look, we were missing two commits from upstream in order to
remove the call to of_node_put(this_leaf->fw_token) in
cache_shared_cpu_map_remove().

Thanks!

# pml -d -n0
Disabling console suspend.
Pass 1 out of 1, mode=none, tp_all=1, cycle_tp=, sleep=, wakeup_time=1
rtcwake: assuming RTC uses UTC ...
rtcwake: wakeup from "mem" using /dev/rtc0 at Thu Jan  1 00:00:47 1970
[   14.944629] PM: suspend entry (deep)
[   14.948256] Filesystems sync: 0.000 seconds
[   14.955442] Freezing user space processes
[   14.960529] Freezing user space processes completed (elapsed 0.001
seconds)
[   14.967507] OOM killer disabled.
[   14.970741] Freezing remaining freezable tasks
[   14.976254] Freezing remaining freezable tasks completed (elapsed
0.001 seconds)
[   15.055371] Disabling non-boot CPUs ...
[   15.059574] OF: ERROR: Bad of_node_put() on
/cpus/cpu@1/cache-controller-1
[   15.066479] CPU: 1 PID: 15 Comm: cpuhp/1 Not tainted
6.1.161-1.7pre-gf269da9a5cdb #2
[   15.074233] Hardware name: BCX974116SFF (DT)
[   15.078507] Call trace:
[   15.080956]  dump_backtrace+0xdc/0x130
[   15.084715]  show_stack+0x1c/0x30
[   15.088035]  dump_stack_lvl+0x60/0x78
[   15.091705]  dump_stack+0x14/0x2c
[   15.095025]  of_node_release+0x144/0x150
[   15.098955]  kobject_put+0xa8/0x210
[   15.102448]  of_node_put+0x1c/0x30
[   15.105855]  cache_shared_cpu_map_remove+0x164/0x230
[   15.110829]  cacheinfo_cpu_pre_down+0x6c/0xb0
[   15.115191]  cpuhp_invoke_callback+0x120/0x680
[   15.119640]  cpuhp_thread_fun+0xd4/0x190
[   15.123567]  smpboot_thread_fn+0x12c/0x220
[   15.127670]  kthread+0x100/0x110
[   15.130902]  ret_from_fork+0x10/0x20
[   15.134504] OF: ERROR: Bad of_node_put() on /cpus/cpu@1
[   15.139776] CPU: 1 PID: 15 Comm: cpuhp/1 Not tainted
6.1.161-1.7pre-gf269da9a5cdb #2
[   15.147530] Hardware name: BCX974116SFF (DT)
[   15.151803] Call trace:
[   15.154251]  dump_backtrace+0xdc/0x130
[   15.158005]  show_stack+0x1c/0x30
[   15.161324]  dump_stack_lvl+0x60/0x78
[   15.164992]  dump_stack+0x14/0x2c
[   15.168312]  of_node_release+0x144/0x150
[   15.172241]  kobject_put+0xa8/0x210
[   15.175734]  kobject_put+0xc0/0x210
[   15.179226]  of_node_put+0x1c/0x30
[   15.182633]  cache_shared_cpu_map_remove+0x164/0x230
[   15.187604]  cacheinfo_cpu_pre_down+0x6c/0xb0
[   15.191967]  cpuhp_invoke_callback+0x120/0x680
[   15.196416]  cpuhp_thread_fun+0xd4/0x190
[   15.200343]  smpboot_thread_fn+0x12c/0x220
[   15.204446]  kthread+0x100/0x110
[   15.207677]  ret_from_fork+0x10/0x20
[   15.211456] psci: CPU1 killed (polled 0 ms)
[   15.217271] OF: ERROR: Bad of_node_put() on
/cpus/cpu@2/cache-controller-2
[   15.224245] CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted
6.1.161-1.7pre-gf269da9a5cdb #2
[   15.232042] Hardware name: BCX974116SFF (DT)
[   15.236342] Call trace:
[   15.238813]  dump_backtrace+0xdc/0x130
[   15.242612]  show_stack+0x1c/0x30
[   15.245969]  dump_stack_lvl+0x60/0x78
[   15.249678]  dump_stack+0x14/0x2c
[   15.253037]  of_node_release+0x144/0x150
[   15.257004]  kobject_put+0xa8/0x210
[   15.260527]  of_node_put+0x1c/0x30
[   15.263968]  cache_shared_cpu_map_remove+0x164/0x230
[   15.268983]  cacheinfo_cpu_pre_down+0x6c/0xb0
[   15.273387]  cpuhp_invoke_callback+0x120/0x680
[   15.277871]  cpuhp_thread_fun+0xd4/0x190
[   15.281831]  smpboot_thread_fn+0x12c/0x220
[   15.285973]  kthread+0x100/0x110
[   15.289235]  ret_from_fork+0x10/0x20
[   15.292926] OF: ERROR: Bad of_node_put() on /cpus/cpu@2
[   15.298301] CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted
6.1.161-1.7pre-gf269da9a5cdb #2
[   15.306097] Hardware name: BCX974116SFF (DT)
[   15.310396] Call trace:
[   15.312865]  dump_backtrace+0xdc/0x130
[   15.316661]  show_stack+0x1c/0x30
[   15.320018]  dump_stack_lvl+0x60/0x78
[   15.323725]  dump_stack+0x14/0x2c
[   15.327082]  of_node_release+0x144/0x150
[   15.331048]  kobject_put+0xa8/0x210
[   15.334572]  kobject_put+0xc0/0x210
[   15.338096]  of_node_put+0x1c/0x30
[   15.341538]  cache_shared_cpu_map_remove+0x164/0x230
[   15.346552]  cacheinfo_cpu_pre_down+0x6c/0xb0
[   15.350955]  cpuhp_invoke_callback+0x120/0x680
[   15.355440]  cpuhp_thread_fun+0xd4/0x190
[   15.359402]  smpboot_thread_fn+0x12c/0x220
[   15.363543]  kthread+0x100/0x110
[   15.366804]  ret_from_fork+0x10/0x20
[   15.370783] psci: CPU2 killed (polled 0 ms)
[   15.375888] OF: ERROR: Bad of_node_put() on
/cpus/cpu@3/cache-controller-3
[   15.382807] CPU: 3 PID: 25 Comm: cpuhp/3 Not tainted
6.1.161-1.7pre-gf269da9a5cdb #2
[   15.390571] Hardware name: BCX974116SFF (DT)
[   15.394851] Call trace:
[   15.397306]  dump_backtrace+0xdc/0x130
[   15.401074]  show_stack+0x1c/0x30
[   15.404403]  dump_stack_lvl+0x60/0x78
[   15.408082]  dump_stack+0x14/0x2c
[   15.411412]  of_node_release+0x144/0x150
[   15.415349]  kobject_put+0xa8/0x210
[   15.418850]  of_node_put+0x1c/0x30
[   15.422264]  cache_shared_cpu_map_remove+0x164/0x230
[   15.427247]  cacheinfo_cpu_pre_down+0x6c/0xb0
[   15.431620]  cpuhp_invoke_callback+0x120/0x680
[   15.436078]  cpuhp_thread_fun+0xd4/0x190
[   15.440013]  smpboot_thread_fn+0x12c/0x220
[   15.444125]  kthread+0x100/0x110
[   15.447364]  ret_from_fork+0x10/0x20
[   15.450987] OF: ERROR: Bad of_node_put() on /cpus/cpu@3
[   15.456263] CPU: 3 PID: 25 Comm: cpuhp/3 Not tainted
6.1.161-1.7pre-gf269da9a5cdb #2
[   15.464027] Hardware name: BCX974116SFF (DT)
[   15.468306] Call trace:
[   15.470759]  dump_backtrace+0xdc/0x130
[   15.474523]  show_stack+0x1c/0x30
[   15.477853]  dump_stack_lvl+0x60/0x78
[   15.481530]  dump_stack+0x14/0x2c
[   15.484860]  of_node_release+0x144/0x150
[   15.488797]  kobject_put+0xa8/0x210
[   15.492297]  kobject_put+0xc0/0x210
[   15.495797]  of_node_put+0x1c/0x30
[   15.499212]  cache_shared_cpu_map_remove+0x164/0x230
[   15.504193]  cacheinfo_cpu_pre_down+0x6c/0xb0
[   15.508567]  cpuhp_invoke_callback+0x120/0x680
[   15.513024]  cpuhp_thread_fun+0xd4/0x190
[   15.516959]  smpboot_thread_fn+0x12c/0x220
[   15.521071]  kthread+0x100/0x110
[   15.524309]  ret_from_fork+0x10/0x20
[   15.528108] psci: CPU3 killed (polled 0 ms)

Pierre Gondois (2):
  cacheinfo: Decrement refcount in cache_setup_of_node()
  cacheinfo: Remove of_node_put() for fw_token

 drivers/base/cacheinfo.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

-- 
2.34.1

[PATCH stable 6.1 1/2] cacheinfo: Decrement refcount in cache_setup_of_node()

[Florian Fainelli]

From: Pierre Gondois <pierre.gondois@arm.com>

commit 3da72e18371c41a6f6f96b594854b178168c7757 upstream

Refcounts to DT nodes are only incremented in the function
and never decremented. Decrease the refcounts when necessary.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Link: https://lore.kernel.org/r/20221026185954.991547-1-pierre.gondois@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/base/cacheinfo.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index 9e11d42b0d64..54a66e4a3460 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -195,7 +195,7 @@ static void cache_of_set_props(struct cacheinfo *this_leaf,
 
 static int cache_setup_of_node(unsigned int cpu)
 {
-	struct device_node *np;
+	struct device_node *np, *prev;
 	struct cacheinfo *this_leaf;
 	unsigned int index = 0;
 
@@ -205,19 +205,24 @@ static int cache_setup_of_node(unsigned int cpu)
 		return -ENOENT;
 	}
 
+	prev = np;
+
 	while (index < cache_leaves(cpu)) {
 		this_leaf = per_cpu_cacheinfo_idx(cpu, index);
-		if (this_leaf->level != 1)
+		if (this_leaf->level != 1) {
 			np = of_find_next_cache_node(np);
-		else
-			np = of_node_get(np);/* cpu node itself */
-		if (!np)
-			break;
+			of_node_put(prev);
+			prev = np;
+			if (!np)
+				break;
+		}
 		cache_of_set_props(this_leaf, np);
 		this_leaf->fw_token = np;
 		index++;
 	}
 
+	of_node_put(np);
+
 	if (index != cache_leaves(cpu)) /* not all OF nodes populated */
 		return -ENOENT;
 
-- 
2.34.1

[PATCH stable 6.1 2/2] cacheinfo: Remove of_node_put() for fw_token

[Florian Fainelli]

From: Pierre Gondois <pierre.gondois@arm.com>

commit 2613cc29c5723881ca603b1a3b50f0107010d5d6 upstream

fw_token is used for DT/ACPI systems to identify CPUs sharing caches.
For DT based systems, fw_token is set to a pointer to a DT node.

commit 3da72e18371c ("cacheinfo: Decrement refcount in
cache_setup_of_node()")
doesn't increment the refcount of fw_token anymore in
cache_setup_of_node(). fw_token is indeed used as a token and not
as a (struct device_node*), so no reference to fw_token should be
kept.

However, [1] is triggered when hotplugging a CPU multiple times
since cache_shared_cpu_map_remove() decrements the refcount to
fw_token at each CPU unplugging, eventually reaching 0.

Remove of_node_put() for fw_token in cache_shared_cpu_map_remove().

[1]
------------[ cut here ]------------
refcount_t: saturated; leaking memory.
WARNING: CPU: 4 PID: 32 at lib/refcount.c:22 refcount_warn_saturate (lib/refcount.c:22 (discriminator 3))
Modules linked in:
CPU: 4 PID: 32 Comm: cpuhp/4 Tainted: G        W          6.1.0-rc1-14091-g9fdf2ca7b9c8 #76
Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Oct 31 2022
pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate (lib/refcount.c:22 (discriminator 3))
lr : refcount_warn_saturate (lib/refcount.c:22 (discriminator 3))
[...]
Call trace:
[...]
of_node_release (drivers/of/dynamic.c:335)
kobject_put (lib/kobject.c:677 lib/kobject.c:704 ./include/linux/kref.h:65 lib/kobject.c:721)
of_node_put (drivers/of/dynamic.c:49)
free_cache_attributes.part.0 (drivers/base/cacheinfo.c:712)
cacheinfo_cpu_pre_down (drivers/base/cacheinfo.c:718)
cpuhp_invoke_callback (kernel/cpu.c:247 (discriminator 4))
cpuhp_thread_fun (kernel/cpu.c:785)
smpboot_thread_fn (kernel/smpboot.c:164 (discriminator 3))
kthread (kernel/kthread.c:376)
ret_from_fork (arch/arm64/kernel/entry.S:861)
---[ end trace 0000000000000000 ]---

Fixes: 3da72e18371c ("cacheinfo: Decrement refcount in cache_setup_of_node()")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Sudeep Holla <sudeep.holla@arm.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Link: https://lore.kernel.org/r/20221116094958.2141072-1-pierre.gondois@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/base/cacheinfo.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index 54a66e4a3460..f41effceea7c 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -409,8 +409,6 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
 				}
 			}
 		}
-		if (of_have_populated_dt())
-			of_node_put(this_leaf->fw_token);
 	}
 
 	/* cpu is no longer populated in the shared map */
-- 
2.34.1