2010-11-18 19:21:13

by Sonny Rao

[permalink] [raw]
Subject: [PATCH] print_cfq_rq: per_cpu(xx, 0) may not exist

Per cpu variables only exist for possible cpus. On some architectures
and platforms, cpu 0 may not be possible, and this debug code generates
an oops.

As a variable for the boot cpu seems to be architecture dependent, replace
this aparently arbitrary choice of reference for spread of min vruntime
across run queues from that of cpu 0 to that of the first online cpu.

Signed-off-by: Milton Miller <[email protected]>
Signed-off-by: Sonny Rao <[email protected]>
---
kernel/sched_debug.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 2e1b0d1..be586db 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -163,7 +163,7 @@ static void task_group_path(struct task_group *tg, char *buf, int buflen)
void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
{
s64 MIN_vruntime = -1, min_vruntime, max_vruntime = -1,
- spread, rq0_min_vruntime, spread0;
+ spread, spread0;
struct rq *rq = cpu_rq(cpu);
struct sched_entity *last;
unsigned long flags;
@@ -188,7 +188,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
if (last)
max_vruntime = last->vruntime;
min_vruntime = cfs_rq->min_vruntime;
- rq0_min_vruntime = cpu_rq(0)->cfs.min_vruntime;
raw_spin_unlock_irqrestore(&rq->lock, flags);
SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "MIN_vruntime",
SPLIT_NS(MIN_vruntime));
@@ -199,7 +198,8 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
spread = max_vruntime - MIN_vruntime;
SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "spread",
SPLIT_NS(spread));
- spread0 = min_vruntime - rq0_min_vruntime;
+ spread0 = min_vruntime - per_cpu(runqueues,
+ cpumask_first(cpu_online_mask)).cfs.min_vruntime;
SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "spread0",
SPLIT_NS(spread0));
SEQ_printf(m, " .%-30s: %ld\n", "nr_running", cfs_rq->nr_running);
--
1.5.6.5


2010-11-18 19:21:42

by Sonny Rao

[permalink] [raw]
Subject: [PATCH] Fix crash in sym53c8xx_2 error path

We have observed NULL pointer dereference crashes in sym53c8xx_2
when a command cannot be found, fix it to check for this case
and print out [unknown cmd] if this happens.

Signed-off-by: Milton Miller <[email protected]>
Signed-off-by: Sonny Rao <[email protected]>
---
drivers/scsi/sym53c8xx_2/sym_hipd.c | 50 +++++++++++++++++++++++++++-------
1 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index 2c3e89d..ad9543e 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -70,9 +70,15 @@ static void sym_printl_hex(u_char *p, int n)
printf (".\n");
}

-static void sym_print_msg(struct sym_ccb *cp, char *label, u_char *msg)
+static void sym_print_msg(struct sym_hcb *np, struct sym_ccb *cp, char *label,
+ u_char *msg)
{
- sym_print_addr(cp->cmd, "%s: ", label);
+ if (cp->cmd) {
+ sym_print_addr(cp->cmd, "%s: ", label);
+ } else {
+ shost_printk(KERN_INFO, np->s.host, "[unknown cmd]"
+ "%s: ", label);
+ }

spi_print_msg(msg);
printf("\n");
@@ -4412,7 +4418,11 @@ static void sym_int_sir(struct sym_hcb *np)
* been selected with ATN. We do not want to handle that.
*/
case SIR_SEL_ATN_NO_MSG_OUT:
- scmd_printk(KERN_WARNING, cp->cmd,
+ if (cp)
+ scmd_printk(KERN_WARNING, cp->cmd,
+ "No MSG OUT phase after selection with ATN\n");
+ else
+ shost_printk(KERN_WARNING, np->s.host, "[unknown cmd]"
"No MSG OUT phase after selection with ATN\n");
goto out_stuck;
/*
@@ -4420,7 +4430,11 @@ static void sym_int_sir(struct sym_hcb *np)
* having reselected the initiator.
*/
case SIR_RESEL_NO_MSG_IN:
- scmd_printk(KERN_WARNING, cp->cmd,
+ if (cp)
+ scmd_printk(KERN_WARNING, cp->cmd,
+ "No MSG IN phase after reselection\n");
+ else
+ shost_printk(KERN_WARNING, np->s.host, "[unknown cmd]"
"No MSG IN phase after reselection\n");
goto out_stuck;
/*
@@ -4428,7 +4442,11 @@ static void sym_int_sir(struct sym_hcb *np)
* an IDENTIFY.
*/
case SIR_RESEL_NO_IDENTIFY:
- scmd_printk(KERN_WARNING, cp->cmd,
+ if (cp)
+ scmd_printk(KERN_WARNING, cp->cmd,
+ "No IDENTIFY after reselection\n");
+ else
+ shost_printk(KERN_WARNING, np->s.host, "[unknown cmd]"
"No IDENTIFY after reselection\n");
goto out_stuck;
/*
@@ -4457,7 +4475,11 @@ static void sym_int_sir(struct sym_hcb *np)
case SIR_RESEL_ABORTED:
np->lastmsg = np->msgout[0];
np->msgout[0] = M_NOOP;
- scmd_printk(KERN_WARNING, cp->cmd,
+ if (cp)
+ scmd_printk(KERN_WARNING, cp->cmd,
+ "message %x sent on bad reselection\n", np->lastmsg);
+ else
+ shost_printk(KERN_WARNING, np->s.host, "[unknown cmd]"
"message %x sent on bad reselection\n", np->lastmsg);
goto out;
/*
@@ -4491,7 +4513,7 @@ static void sym_int_sir(struct sym_hcb *np)
* REJECT message.
*/
case SIR_REJECT_TO_SEND:
- sym_print_msg(cp, "M_REJECT to send for ", np->msgin);
+ sym_print_msg(np, cp, "M_REJECT to send for ", np->msgin);
np->msgout[0] = M_REJECT;
goto out;
/*
@@ -4555,7 +4577,7 @@ static void sym_int_sir(struct sym_hcb *np)
switch (np->msgin [2]) {
case M_X_MODIFY_DP:
if (DEBUG_FLAGS & DEBUG_POINTER)
- sym_print_msg(cp, "extended msg ",
+ sym_print_msg(np, cp, "extended msg ",
np->msgin);
tmp = (np->msgin[3]<<24) + (np->msgin[4]<<16) +
(np->msgin[5]<<8) + (np->msgin[6]);
@@ -4583,7 +4605,7 @@ static void sym_int_sir(struct sym_hcb *np)
*/
case M_IGN_RESIDUE:
if (DEBUG_FLAGS & DEBUG_POINTER)
- sym_print_msg(cp, "1 or 2 byte ", np->msgin);
+ sym_print_msg(np, cp, "1 or 2 byte ", np->msgin);
if (cp->host_flags & HF_SENSE)
OUTL_DSP(np, SCRIPTA_BA(np, clrack));
else
@@ -4593,7 +4615,13 @@ static void sym_int_sir(struct sym_hcb *np)
if (INB(np, HS_PRT) == HS_NEGOTIATE)
sym_nego_rejected(np, tp, cp);
else {
- sym_print_addr(cp->cmd,
+ if (cp)
+ sym_print_addr(cp->cmd,
+ "M_REJECT received (%x:%x).\n",
+ scr_to_cpu(np->lastmsg), np->msgout[0]);
+ else
+ shost_printk(KERN_INFO, np->s.host,
+ "[unknown cmd]"
"M_REJECT received (%x:%x).\n",
scr_to_cpu(np->lastmsg), np->msgout[0]);
}
@@ -4608,7 +4636,7 @@ static void sym_int_sir(struct sym_hcb *np)
* Ignore all MSG IN phases and reject it.
*/
case SIR_MSG_WEIRD:
- sym_print_msg(cp, "WEIRD message received", np->msgin);
+ sym_print_msg(np, cp, "WEIRD message received", np->msgin);
OUTL_DSP(np, SCRIPTB_BA(np, msg_weird));
return;
/*
--
1.5.6.5