2014-12-08 11:17:51

by Kirill Smelkov

Subject: [PATCH] tools/liblockdep: Fix debug_check thinko in mutex destroy

In mutex destroy code currently we pass to debug_check_no_locks_freed()

[mem_from, mem_end)

address region. But debug_check_no_locks_freed() accepts

mem_from, mem_*len*

i.e. second parameter is region length, not end address. And it was
always so, starting from 2006 (fbb9ce95 "lockdep: core").

Fix it, or else on a mutex destroy we wrongly check
much-wider-than-mutex region and can find not-yet-released other locks
there and wrongly report BUGs on them.

Signed-off-by: Kirill Smelkov <[email protected]>
---
tools/lib/lockdep/preload.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/lib/lockdep/preload.c b/tools/lib/lockdep/preload.c
index 6f80360..0b0112c 100644
--- a/tools/lib/lockdep/preload.c
+++ b/tools/lib/lockdep/preload.c
@@ -317,7 +317,7 @@ int pthread_mutex_destroy(pthread_mutex_t *mutex)
*
* TODO: Hook into free() and add that check there as well.
*/
- debug_check_no_locks_freed(mutex, mutex + sizeof(*mutex));
+ debug_check_no_locks_freed(mutex, sizeof(*mutex));
__del_lock(__get_lock(mutex));
return ll_pthread_mutex_destroy(mutex);
}
@@ -341,7 +341,7 @@ int pthread_rwlock_destroy(pthread_rwlock_t *rwlock)
{
try_init_preload();

- debug_check_no_locks_freed(rwlock, rwlock + sizeof(*rwlock));
+ debug_check_no_locks_freed(rwlock, sizeof(*rwlock));
__del_lock(__get_lock(rwlock));
return ll_pthread_rwlock_destroy(rwlock);
}
--
2.2.0.309.gc3c329f

2014-12-08 15:00:04

by Sasha Levin

Subject: Re: [PATCH] tools/liblockdep: Fix debug_check thinko in mutex destroy

On 12/08/2014 06:07 AM, Kirill Smelkov wrote:
> In mutex destroy code currently we pass to debug_check_no_locks_freed()
>
> [mem_from, mem_end)
>
> address region. But debug_check_no_locks_freed() accepts
>
> mem_from, mem_*len*
>
> i.e. second parameter is region length, not end address. And it was
> always so, starting from 2006 (fbb9ce95 "lockdep: core").
>
> Fix it, or else on a mutex destroy we wrongly check
> much-wider-than-mutex region and can find not-yet-released other locks
> there and wrongly report BUGs on them.

Great catch, thanks!


Thanks,
Sasha

2014-12-14 14:21:20

by Kirill Smelkov

Subject: Re: [PATCH] tools/liblockdep: Fix debug_check thinko in mutex destroy

On Mon, Dec 08, 2014 at 09:59:54AM -0500, Sasha Levin wrote:
> On 12/08/2014 06:07 AM, Kirill Smelkov wrote:
> > In mutex destroy code currently we pass to debug_check_no_locks_freed()
> >
> > [mem_from, mem_end)
> >
> > address region. But debug_check_no_locks_freed() accepts
> >
> > mem_from, mem_*len*
> >
> > i.e. second parameter is region length, not end address. And it was
> > always so, starting from 2006 (fbb9ce95 "lockdep: core").
> >
> > Fix it, or else on a mutex destroy we wrongly check
> > much-wider-than-mutex region and can find not-yet-released other locks
> > there and wrongly report BUGs on them.
>
> Great catch, thanks!

Thanks, where is this patch is/will-be applied?

I mean I could not find it neither in

git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux.git

nor anywhere in linux-next nor in Linus's tree.

Thanks,
Kirill

2014-12-14 14:31:01

by Sasha Levin

Subject: Re: [PATCH] tools/liblockdep: Fix debug_check thinko in mutex destroy

On 12/14/2014 09:21 AM, Kirill Smelkov wrote:
> On Mon, Dec 08, 2014 at 09:59:54AM -0500, Sasha Levin wrote:
>> > On 12/08/2014 06:07 AM, Kirill Smelkov wrote:
>>> > > In mutex destroy code currently we pass to debug_check_no_locks_freed()
>>> > >
>>> > > [mem_from, mem_end)
>>> > >
>>> > > address region. But debug_check_no_locks_freed() accepts
>>> > >
>>> > > mem_from, mem_*len*
>>> > >
>>> > > i.e. second parameter is region length, not end address. And it was
>>> > > always so, starting from 2006 (fbb9ce95 "lockdep: core").
>>> > >
>>> > > Fix it, or else on a mutex destroy we wrongly check
>>> > > much-wider-than-mutex region and can find not-yet-released other locks
>>> > > there and wrongly report BUGs on them.
>> >
>> > Great catch, thanks!
> Thanks, where is this patch is/will-be applied?
>
> I mean I could not find it neither in
>
> git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux.git
>
> nor anywhere in linux-next nor in Linus's tree.

I'll send it to Ingo once v3.19-rc1 is out.


Thanks,
Sasha