Message-ID: <20170227214747.GA30307@roeck-us.net>
Date:   Mon, 27 Feb 2017 13:47:47 -0800
From:   Guenter Roeck <linux@...ck-us.net>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org
Subject: next: runtime warning after 'locking/refcounts: Out-of-line
 everything'

Hi Peter,

I see the following runtime warning when running a 44x/virtex5_defconfig
image in qemu (virtex-ml507).

refcount_t: underflow; use-after-free.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at lib/refcount.c:128 refcount_sub_and_test+0x90/0xd0
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 4.10.0-next-20170227 #1
task: cf81d5a0 task.stack: cf81e000
NIP: c02100e0 LR: c02100e0 CTR: c0279970
REGS: cf81fc90 TRAP: 0700   Not tainted  (4.10.0-next-20170227)
MSR: 00029000 <CE,EE,ME>
CR: 24000022  XER: 00000000

GPR00: c02100e0 cf81fd40 cf81d5a0 00000026 00000000 00000000 c027a3d0 00000000 
GPR08: c05403bc 00000800 00000000 00000000 24000024 00000000 c0001ad0 00000000 
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 c054b3c0 c0550000 
GPR24: 00000000 00000000 cf948010 00000015 00000000 00000000 cf948000 cfb1c0e8 
NIP [c02100e0] refcount_sub_and_test+0x90/0xd0
LR [c02100e0] refcount_sub_and_test+0x90/0xd0
Call Trace:
[cf81fd40] [c02100e0] refcount_sub_and_test+0x90/0xd0 (unreliable)
[cf81fd50] [c01f6564] kobject_put+0x34/0x90
[cf81fd60] [c02ac240] ace_probe+0x410/0x450
[cf81fda0] [c0293684] platform_drv_probe+0x44/0xc0
[cf81fdc0] [c0291494] driver_probe_device+0x234/0x340
[cf81fdf0] [c029166c] __driver_attach+0xcc/0xd0
[cf81fe10] [c028eff8] bus_for_each_dev+0x68/0xc0
[cf81fe40] [c0290838] bus_add_driver+0x208/0x280
[cf81fe60] [c0292198] driver_register+0x88/0x140
[cf81fe70] [c050be10] ace_init+0x48/0xa4
[cf81fe90] [c0001350] do_one_initcall+0x40/0x180
[cf81fef0] [c04f2ae0] kernel_init_freeable+0x134/0x1cc
[cf81ff30] [c0001ae4] kernel_init+0x14/0x110
[cf81ff40] [c000c3d0] ret_from_kernel_thread+0x5c/0x64
Instruction dump:
40a2fff0 7f884840 7d094378 419e0044 2f89ffff 7d434850 7f0a4840 419e0018 
4099ffd0 3c60c04b 386393f0 4820e99d <0fe00000> 80010014 38600000 38210010 
---[ end trace 17bd7014e44a5b26 ]---
xsysace 83600000.sysace: xsysace: error initializing device at 0x83600000
xsysace 83600000.sysace: could not initialize device, err=-12
xsysace: probe of 83600000.sysace failed with error -12
Xilinx SystemACE device driver, major=254

The complete log is available at
http://kerneltests.org/builders/qemu-ppc-next/builds/590/steps/qemubuildcommand/logs/stdio

Bisect points to commit 29dee3c03abc ("locking/refcounts: Out-of-line
everything'); bisect log is attached. Reverting this commit fixes the problem.

Please let me know if there is anything I can do to help tracking down the
problem.

[ Maybe there is a bug in the ace driver's error handler, but why is it only
  seen with your patch applied ? ]

Guenter

---
# bad: [2b9bda0679b5b4481396190d2f482fb9b31984f5] Revert "objtool: Improve detection of BUG() and other dead ends"
# good: [c470abd4fde40ea6a0846a2beab642a578c0b8cd] Linux 4.10
git bisect start 'HEAD' 'v4.10'
# good: [caa59428971d5ad81d19512365c9ba580d83268c] Merge tag 'staging-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
git bisect good caa59428971d5ad81d19512365c9ba580d83268c
# good: [d5500a074741b78b7f778b4ab3415d5ecdcda0a7] Merge tag 'usercopy-v4.11-rc1.fix' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
git bisect good d5500a074741b78b7f778b4ab3415d5ecdcda0a7
# good: [5d8a00eee2ed2e548a5d21b0edf495f3f7bf8bb4] Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
git bisect good 5d8a00eee2ed2e548a5d21b0edf495f3f7bf8bb4
# good: [017bfb6c372fa793cdb09828597a464fa24e0ea7] Merge remote-tracking branch 'jfs/jfs-next'
git bisect good 017bfb6c372fa793cdb09828597a464fa24e0ea7
# bad: [e2a95a3fe9e9586df29e8d673dc8cdd36ed6158b] Merge remote-tracking branch 'edac/linux_next'
git bisect bad e2a95a3fe9e9586df29e8d673dc8cdd36ed6158b
# good: [736e441efdafdbf0bb32732d87e00b8ba7f75260] Merge remote-tracking branch 'thermal/next'
git bisect good 736e441efdafdbf0bb32732d87e00b8ba7f75260
# good: [5bd695c24b294b482d86d352a4a0c7ba2059dcff] Merge remote-tracking branch 'block/for-next'
git bisect good 5bd695c24b294b482d86d352a4a0c7ba2059dcff
# good: [690962e72babac64c8240071e106d2c3e8d08306] Merge remote-tracking branch 'spi/for-next'
git bisect good 690962e72babac64c8240071e106d2c3e8d08306
# bad: [462a53b1a2f984a8c8c0aade1c461ce9ea156d5b] Merge branch 'perf/urgent'
git bisect bad 462a53b1a2f984a8c8c0aade1c461ce9ea156d5b
# good: [bb963e16507ca7670f0bb47ccaada8874b2ba6a1] perf utils: Check verbose flag properly
git bisect good bb963e16507ca7670f0bb47ccaada8874b2ba6a1
# good: [7bbba0eb1af34694868d028b80475981f90e6bee] perf/core: Fix perf_event_enable_on_exec() timekeeping (again)
git bisect good 7bbba0eb1af34694868d028b80475981f90e6bee
# good: [1db159781cc7df093085ccaddc022beaaa9dd990] Merge branch 'core/urgent'
git bisect good 1db159781cc7df093085ccaddc022beaaa9dd990
# bad: [318b1dedcd39012624f466d281627553e9fa2570] locking/refcounts: Add missing kernel.h header to have UINT_MAX defined
git bisect bad 318b1dedcd39012624f466d281627553e9fa2570
# bad: [29dee3c03abce04cd527878ef5f9e5f91b7b83f4] locking/refcounts: Out-of-line everything
git bisect bad 29dee3c03abce04cd527878ef5f9e5f91b7b83f4
# first bad commit: [29dee3c03abce04cd527878ef5f9e5f91b7b83f4] locking/refcounts: Out-of-line everything

Powered by blists - more mailing lists