| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1413219067-15328-3-git-send-email-mugunthanvnm@ti.com>
Date: Mon, 13 Oct 2014 22:21:06 +0530
From: Mugunthan V N <mugunthanvnm@...com>
To: <netdev@...r.kernel.org>
CC: <davem@...emloft.net>, Mugunthan V N <mugunthanvnm@...com>
Subject: [net PATCH 2/3] drivers: net: davinci_cpdma: remove spinlock as SOFTIRQ-unsafe lock order detected
remove spinlock in cpdma_desc_pool_destroy() as there is no active cpdma
channel and iounmap should be called without auquiring lock.
root@...7xx-evm:~# modprobe -r ti_cpsw
[ 50.539743]
[ 50.541312] ======================================================
[ 50.547796] [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ]
[ 50.554826] 3.14.19-02124-g95c5b7b #308 Not tainted
[ 50.559939] ------------------------------------------------------
[ 50.566416] modprobe/1921 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
[ 50.573347] (vmap_area_lock){+.+...}, at: [<c01127fc>] find_vmap_area+0x10/0x6c
[ 50.581132]
[ 50.581132] and this task is already holding:
[ 50.587249] (&(&pool->lock)->rlock#2){..-...}, at: [<bf017c74>] cpdma_ctlr_destroy+0x5c/0x114 [davinci_cpdma]
[ 50.597766] which would create a new lock dependency:
[ 50.603048] (&(&pool->lock)->rlock#2){..-...} -> (vmap_area_lock){+.+...}
[ 50.610296]
[ 50.610296] but this new dependency connects a SOFTIRQ-irq-safe lock:
[ 50.618601] (&(&pool->lock)->rlock#2){..-...}
... which became SOFTIRQ-irq-safe at:
[ 50.626829] [<c06585a4>] _raw_spin_lock_irqsave+0x38/0x4c
[ 50.632677] [<bf01773c>] cpdma_desc_free.constprop.7+0x28/0x58 [davinci_cpdma]
[ 50.640437] [<bf0177e8>] __cpdma_chan_free+0x7c/0xa8 [davinci_cpdma]
[ 50.647289] [<bf017908>] __cpdma_chan_process+0xf4/0x134 [davinci_cpdma]
[ 50.654512] [<bf017984>] cpdma_chan_process+0x3c/0x54 [davinci_cpdma]
[ 50.661455] [<bf0277e8>] cpsw_poll+0x14/0xa8 [ti_cpsw]
[ 50.667038] [<c05844f4>] net_rx_action+0xc0/0x1e8
[ 50.672150] [<c0048234>] __do_softirq+0xcc/0x304
[ 50.677183] [<c004873c>] irq_exit+0xa8/0xfc
[ 50.681751] [<c000eeac>] handle_IRQ+0x50/0xb0
[ 50.686513] [<c0008638>] gic_handle_irq+0x28/0x5c
[ 50.691628] [<c06590a4>] __irq_svc+0x44/0x5c
[ 50.696289] [<c0658ab4>] _raw_spin_unlock_irqrestore+0x34/0x44
[ 50.702591] [<c065a9c4>] do_page_fault.part.9+0x144/0x3c4
[ 50.708433] [<c065acb8>] do_page_fault+0x74/0x84
[ 50.713453] [<c00083dc>] do_DataAbort+0x34/0x98
[ 50.718391] [<c065923c>] __dabt_usr+0x3c/0x40
[ 50.723148]
[ 50.723148] to a SOFTIRQ-irq-unsafe lock:
[ 50.728893] (vmap_area_lock){+.+...}
... which became SOFTIRQ-irq-unsafe at:
[ 50.736476] ... [<c06584e8>] _raw_spin_lock+0x28/0x38
[ 50.741876] [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
[ 50.747908] [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
[ 50.754210] [<c011486c>] get_vm_area_caller+0x3c/0x48
[ 50.759692] [<c0114be0>] vmap+0x40/0x78
[ 50.763900] [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
[ 50.769835] [<c093eac0>] start_kernel+0x320/0x388
[ 50.774952] [<80008074>] 0x80008074
[ 50.778793]
[ 50.778793] other info that might help us debug this:
[ 50.778793]
[ 50.787181] Possible interrupt unsafe locking scenario:
[ 50.787181]
[ 50.794295] CPU0 CPU1
[ 50.799042] ---- ----
[ 50.803785] lock(vmap_area_lock);
[ 50.807446] local_irq_disable();
[ 50.813652] lock(&(&pool->lock)->rlock#2);
[ 50.820782] lock(vmap_area_lock);
[ 50.827086] <Interrupt>
[ 50.829823] lock(&(&pool->lock)->rlock#2);
[ 50.834490]
[ 50.834490] *** DEADLOCK ***
[ 50.834490]
[ 50.840695] 4 locks held by modprobe/1921:
[ 50.844981] #0: (&__lockdep_no_validate__){......}, at: [<c03e53e8>] driver_detach+0x44/0xb8
[ 50.854038] #1: (&__lockdep_no_validate__){......}, at: [<c03e53f4>] driver_detach+0x50/0xb8
[ 50.863102] #2: (&(&ctlr->lock)->rlock){......}, at: [<bf017c34>] cpdma_ctlr_destroy+0x1c/0x114 [davinci_cpdma]
[ 50.873890] #3: (&(&pool->lock)->rlock#2){..-...}, at: [<bf017c74>] cpdma_ctlr_destroy+0x5c/0x114 [davinci_cpdma]
[ 50.884871]
the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
[ 50.892827] -> (&(&pool->lock)->rlock#2){..-...} ops: 167 {
[ 50.898703] IN-SOFTIRQ-W at:
[ 50.901995] [<c06585a4>] _raw_spin_lock_irqsave+0x38/0x4c
[ 50.909476] [<bf01773c>] cpdma_desc_free.constprop.7+0x28/0x58 [davinci_cpdma]
[ 50.918878] [<bf0177e8>] __cpdma_chan_free+0x7c/0xa8 [davinci_cpdma]
[ 50.927366] [<bf017908>] __cpdma_chan_process+0xf4/0x134 [davinci_cpdma]
[ 50.936218] [<bf017984>] cpdma_chan_process+0x3c/0x54 [davinci_cpdma]
[ 50.944794] [<bf0277e8>] cpsw_poll+0x14/0xa8 [ti_cpsw]
[ 50.952009] [<c05844f4>] net_rx_action+0xc0/0x1e8
[ 50.958765] [<c0048234>] __do_softirq+0xcc/0x304
[ 50.965432] [<c004873c>] irq_exit+0xa8/0xfc
[ 50.971635] [<c000eeac>] handle_IRQ+0x50/0xb0
[ 50.978035] [<c0008638>] gic_handle_irq+0x28/0x5c
[ 50.984788] [<c06590a4>] __irq_svc+0x44/0x5c
[ 50.991085] [<c0658ab4>] _raw_spin_unlock_irqrestore+0x34/0x44
[ 50.999023] [<c065a9c4>] do_page_fault.part.9+0x144/0x3c4
[ 51.006510] [<c065acb8>] do_page_fault+0x74/0x84
[ 51.013171] [<c00083dc>] do_DataAbort+0x34/0x98
[ 51.019738] [<c065923c>] __dabt_usr+0x3c/0x40
[ 51.026129] INITIAL USE at:
[ 51.029335] [<c06585a4>] _raw_spin_lock_irqsave+0x38/0x4c
[ 51.036729] [<bf017d78>] cpdma_chan_submit+0x4c/0x2f0 [davinci_cpdma]
[ 51.045225] [<bf02863c>] cpsw_ndo_open+0x378/0x6bc [ti_cpsw]
[ 51.052897] [<c058747c>] __dev_open+0x9c/0x104
[ 51.059287] [<c05876ec>] __dev_change_flags+0x88/0x160
[ 51.066420] [<c05877e4>] dev_change_flags+0x18/0x48
[ 51.073270] [<c05ed51c>] devinet_ioctl+0x61c/0x6e0
[ 51.080029] [<c056ee54>] sock_ioctl+0x5c/0x298
[ 51.086418] [<c01350a4>] do_vfs_ioctl+0x78/0x61c
[ 51.092993] [<c01356ac>] SyS_ioctl+0x64/0x74
[ 51.099200] [<c000e580>] ret_fast_syscall+0x0/0x48
[ 51.105956] }
[ 51.107696] ... key at: [<bf019000>] __key.21312+0x0/0xfffff650 [davinci_cpdma]
[ 51.115912] ... acquired at:
[ 51.119019] [<c00899ac>] lock_acquire+0x9c/0x104
[ 51.124138] [<c06584e8>] _raw_spin_lock+0x28/0x38
[ 51.129341] [<c01127fc>] find_vmap_area+0x10/0x6c
[ 51.134547] [<c0114960>] remove_vm_area+0x8/0x6c
[ 51.139659] [<c0114a7c>] __vunmap+0x20/0xf8
[ 51.144318] [<c001c350>] __arm_iounmap+0x10/0x18
[ 51.149440] [<bf017d08>] cpdma_ctlr_destroy+0xf0/0x114 [davinci_cpdma]
[ 51.156560] [<bf026294>] cpsw_remove+0x48/0x8c [ti_cpsw]
[ 51.162407] [<c03e62c8>] platform_drv_remove+0x18/0x1c
[ 51.168063] [<c03e4c44>] __device_release_driver+0x70/0xc8
[ 51.174094] [<c03e5458>] driver_detach+0xb4/0xb8
[ 51.179212] [<c03e4a6c>] bus_remove_driver+0x4c/0x90
[ 51.184693] [<c00b024c>] SyS_delete_module+0x10c/0x198
[ 51.190355] [<c000e580>] ret_fast_syscall+0x0/0x48
[ 51.195661]
[ 51.197217]
the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock:
[ 51.205986] -> (vmap_area_lock){+.+...} ops: 520 {
[ 51.211032] HARDIRQ-ON-W at:
[ 51.214321] [<c06584e8>] _raw_spin_lock+0x28/0x38
[ 51.221090] [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
[ 51.228750] [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
[ 51.236690] [<c011486c>] get_vm_area_caller+0x3c/0x48
[ 51.243811] [<c0114be0>] vmap+0x40/0x78
[ 51.249654] [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
[ 51.257239] [<c093eac0>] start_kernel+0x320/0x388
[ 51.263994] [<80008074>] 0x80008074
[ 51.269474] SOFTIRQ-ON-W at:
[ 51.272769] [<c06584e8>] _raw_spin_lock+0x28/0x38
[ 51.279525] [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
[ 51.287190] [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
[ 51.295126] [<c011486c>] get_vm_area_caller+0x3c/0x48
[ 51.302245] [<c0114be0>] vmap+0x40/0x78
[ 51.308094] [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
[ 51.315669] [<c093eac0>] start_kernel+0x320/0x388
[ 51.322423] [<80008074>] 0x80008074
[ 51.327906] INITIAL USE at:
[ 51.331112] [<c06584e8>] _raw_spin_lock+0x28/0x38
[ 51.337775] [<c011376c>] alloc_vmap_area.isra.28+0xb8/0x300
[ 51.345352] [<c0113a44>] __get_vm_area_node.isra.29+0x90/0x134
[ 51.353197] [<c011486c>] get_vm_area_caller+0x3c/0x48
[ 51.360224] [<c0114be0>] vmap+0x40/0x78
[ 51.365977] [<c09442f0>] check_writebuffer_bugs+0x54/0x1a0
[ 51.373464] [<c093eac0>] start_kernel+0x320/0x388
[ 51.380131] [<80008074>] 0x80008074
[ 51.385517] }
[ 51.387260] ... key at: [<c0a66948>] vmap_area_lock+0x10/0x20
[ 51.393841] ... acquired at:
[ 51.396945] [<c00899ac>] lock_acquire+0x9c/0x104
[ 51.402060] [<c06584e8>] _raw_spin_lock+0x28/0x38
[ 51.407266] [<c01127fc>] find_vmap_area+0x10/0x6c
[ 51.412478] [<c0114960>] remove_vm_area+0x8/0x6c
[ 51.417592] [<c0114a7c>] __vunmap+0x20/0xf8
[ 51.422252] [<c001c350>] __arm_iounmap+0x10/0x18
[ 51.427369] [<bf017d08>] cpdma_ctlr_destroy+0xf0/0x114 [davinci_cpdma]
[ 51.434487] [<bf026294>] cpsw_remove+0x48/0x8c [ti_cpsw]
[ 51.440336] [<c03e62c8>] platform_drv_remove+0x18/0x1c
[ 51.446000] [<c03e4c44>] __device_release_driver+0x70/0xc8
[ 51.452031] [<c03e5458>] driver_detach+0xb4/0xb8
[ 51.457147] [<c03e4a6c>] bus_remove_driver+0x4c/0x90
[ 51.462628] [<c00b024c>] SyS_delete_module+0x10c/0x198
[ 51.468289] [<c000e580>] ret_fast_syscall+0x0/0x48
[ 51.473584]
[ 51.475140]
[ 51.475140] stack backtrace:
[ 51.479703] CPU: 0 PID: 1921 Comm: modprobe Not tainted 3.14.19-02124-g95c5b7b #308
[ 51.487744] [<c0016090>] (unwind_backtrace) from [<c0012060>] (show_stack+0x10/0x14)
[ 51.495865] [<c0012060>] (show_stack) from [<c0652a20>] (dump_stack+0x78/0x94)
[ 51.503444] [<c0652a20>] (dump_stack) from [<c0086f18>] (check_usage+0x408/0x594)
[ 51.511293] [<c0086f18>] (check_usage) from [<c00870f8>] (check_irq_usage+0x54/0xb0)
[ 51.519416] [<c00870f8>] (check_irq_usage) from [<c0088724>] (__lock_acquire+0xe54/0x1b90)
[ 51.528077] [<c0088724>] (__lock_acquire) from [<c00899ac>] (lock_acquire+0x9c/0x104)
[ 51.536291] [<c00899ac>] (lock_acquire) from [<c06584e8>] (_raw_spin_lock+0x28/0x38)
[ 51.544417] [<c06584e8>] (_raw_spin_lock) from [<c01127fc>] (find_vmap_area+0x10/0x6c)
[ 51.552726] [<c01127fc>] (find_vmap_area) from [<c0114960>] (remove_vm_area+0x8/0x6c)
[ 51.560935] [<c0114960>] (remove_vm_area) from [<c0114a7c>] (__vunmap+0x20/0xf8)
[ 51.568693] [<c0114a7c>] (__vunmap) from [<c001c350>] (__arm_iounmap+0x10/0x18)
[ 51.576362] [<c001c350>] (__arm_iounmap) from [<bf017d08>] (cpdma_ctlr_destroy+0xf0/0x114 [davinci_cpdma])
[ 51.586494] [<bf017d08>] (cpdma_ctlr_destroy [davinci_cpdma]) from [<bf026294>] (cpsw_remove+0x48/0x8c [ti_cpsw])
[ 51.597261] [<bf026294>] (cpsw_remove [ti_cpsw]) from [<c03e62c8>] (platform_drv_remove+0x18/0x1c)
[ 51.606659] [<c03e62c8>] (platform_drv_remove) from [<c03e4c44>] (__device_release_driver+0x70/0xc8)
[ 51.616237] [<c03e4c44>] (__device_release_driver) from [<c03e5458>] (driver_detach+0xb4/0xb8)
[ 51.625264] [<c03e5458>] (driver_detach) from [<c03e4a6c>] (bus_remove_driver+0x4c/0x90)
[ 51.633749] [<c03e4a6c>] (bus_remove_driver) from [<c00b024c>] (SyS_delete_module+0x10c/0x198)
[ 51.642781] [<c00b024c>] (SyS_delete_module) from [<c000e580>] (ret_fast_syscall+0x0/0x48)
Signed-off-by: Mugunthan V N <mugunthanvnm@...com>
---
drivers/net/ethernet/ti/davinci_cpdma.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 32dc289..657b65b 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -193,12 +193,9 @@ fail:
static void cpdma_desc_pool_destroy(struct cpdma_desc_pool *pool)
{
- unsigned long flags;
-
if (!pool)
return;
- spin_lock_irqsave(&pool->lock, flags);
WARN_ON(pool->used_desc);
if (pool->cpumap) {
dma_free_coherent(pool->dev, pool->mem_size, pool->cpumap,
@@ -206,7 +203,6 @@ static void cpdma_desc_pool_destroy(struct cpdma_desc_pool *pool)
} else {
iounmap(pool->iomap);
}
- spin_unlock_irqrestore(&pool->lock, flags);
}
static inline dma_addr_t desc_phys(struct cpdma_desc_pool *pool,
--
2.1.1.332.g0bf7dd6
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists