Hi Greg,
This is really small, but I'm including a signed tag anyway. These are
a bugfix and a documentation update. The fix is for a bug in v4.20, and
given that it's late -rc7, it makes more sense to me to queue it for the
merge window, but if you think otherwise, as Linus mentioned the
possibility of an -rc8, it's also good. Stable CC'd on the fix.
The following changes since commit 54ecb8f7028c5eb3d740bb82b0f1d90f2df63c5c:
Linux 5.4-rc1 (2019-09-30 10:35:40 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/ash/stm.git tags/stm-intel_th-for-greg-20191114
for you to fetch changes up to a5e809f25f41a84b31e17ac9422fb191e2495503:
intel_th: Document software sinks (2019-11-14 08:20:17 +0200)
----------------------------------------------------------------
stm class/intel_th: Updates for v5.5
These are:
* a bugfix in stm protocol handling
* a documentation update for intel_th
----------------------------------------------------------------
Alexander Shishkin (2):
stm class: Lose the protocol driver when dropping its reference
intel_th: Document software sinks
Documentation/trace/intel_th.rst | 28 +++++++++++++++++++++++++++-
drivers/hwtracing/stm/policy.c | 4 ++++
2 files changed, 31 insertions(+), 1 deletion(-)
--
2.24.0
Commit c7fd62bc69d02 ("stm class: Introduce framing protocol drivers")
forgot to tear down the link between an stm device and its protocol
driver when policy is removed. This leads to an invalid pointer reference
if one tries to write to an stm device after the policy has been removed
and the protocol driver module unloaded, leading to the below splat:
> BUG: unable to handle page fault for address: ffffffffc0737068
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 3d780f067 P4D 3d780f067 PUD 3d7811067 PMD 492781067 PTE 0
> Oops: 0000 [#1] SMP NOPTI
> CPU: 1 PID: 26122 Comm: cat Not tainted 5.4.0-rc5+ #1
> RIP: 0010:stm_output_free+0x40/0xc0 [stm_core]
> Call Trace:
> stm_char_release+0x3e/0x70 [stm_core]
> __fput+0xc6/0x260
> ____fput+0xe/0x10
> task_work_run+0x9d/0xc0
> exit_to_usermode_loop+0x103/0x110
> do_syscall_64+0x19d/0x1e0
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fix this by tearing down the link from an stm device to its protocol
driver when the policy involving that driver is removed.
Signed-off-by: Alexander Shishkin <[email protected]>
Fixes: c7fd62bc69d02 ("stm class: Introduce framing protocol drivers")
Reported-by: Ammy Yi <[email protected]>
Tested-by: Ammy Yi <[email protected]>
CC: [email protected] # v4.20+
---
drivers/hwtracing/stm/policy.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
index 4b9e44b227d8..4f932a419752 100644
--- a/drivers/hwtracing/stm/policy.c
+++ b/drivers/hwtracing/stm/policy.c
@@ -345,7 +345,11 @@ void stp_policy_unbind(struct stp_policy *policy)
stm->policy = NULL;
policy->stm = NULL;
+ /*
+ * Drop the reference on the protocol driver and lose the link.
+ */
stm_put_protocol(stm->pdrv);
+ stm->pdrv = NULL;
stm_put_device(stm);
}
--
2.24.0
On Thu, Nov 14, 2019 at 08:41:59AM +0200, Alexander Shishkin wrote:
> Hi Greg,
>
> This is really small, but I'm including a signed tag anyway. These are
> a bugfix and a documentation update. The fix is for a bug in v4.20, and
> given that it's late -rc7, it makes more sense to me to queue it for the
> merge window, but if you think otherwise, as Linus mentioned the
> possibility of an -rc8, it's also good. Stable CC'd on the fix.
>
> The following changes since commit 54ecb8f7028c5eb3d740bb82b0f1d90f2df63c5c:
>
> Linux 5.4-rc1 (2019-09-30 10:35:40 -0700)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/ash/stm.git tags/stm-intel_th-for-greg-20191114
>
> for you to fetch changes up to a5e809f25f41a84b31e17ac9422fb191e2495503:
Looks good, I've taken these as patches, thanks.
greg k-h