Hello,
I updated the Linux kernel to commit fe15c26ee26e ("Linux 6.3-rc1")
and found that when the system boots to systemd ranom initialization,
panic, as follows:
[ 3.607299] BUG: unable to handle page fault for address: 000000000001cc43
[ 3.607558] #PF: supervisor read access in kernel mode
[ 3.607704] #PF: error_code(0x0000) - not-present page
[ 3.607704] PGD 0 P4D 0
[ 3.607704] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 3.607704] CPU: 1 PID: 1 Comm: systemd Not tainted 6.3.0-rc1 #50
[ 3.607704] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 3.607704] RIP: 0010:_raw_spin_lock+0x12/0x30
[ 3.607704] Code: 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 ff 05 dd de 1e 7e 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e9 9c 00 00 00 6
[ 3.607704] RSP: 0018:ffffc90000013d50 EFLAGS: 00000002
[ 3.607704] RAX: 0000000000000000 RBX: 0000000000000040 RCX: 0000000000000002
[ 3.607704] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 000000000001cc43
[ 3.607704] RBP: ffffc90000013dc8 R08: 00000000d6fbd601 R09: 0000000065abc912
[ 3.607704] R10: 00000000ba93b167 R11: 000000007bb5d0bf R12: 000000000001cc43
[ 3.607704] R13: 000000000001cc43 R14: 0000000000000003 R15: 0000000000000003
[ 3.607704] FS: 00007fbd4911b400(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[ 3.607704] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.607704] CR2: 000000000001cc43 CR3: 0000000003b42000 CR4: 00000000000006e0
[ 3.607704] Call Trace:
[ 3.607704] <TASK>
[ 3.607704] add_timer_on+0x80/0x130
[ 3.607704] try_to_generate_entropy+0x246/0x270
[ 3.607704] ? do_filp_open+0xb1/0x160
[ 3.607704] ? __pfx_entropy_timer+0x10/0x10
[ 3.607704] ? inode_security+0x1d/0x60
[ 3.607704] urandom_read_iter+0x23/0x90
[ 3.607704] vfs_read+0x203/0x2d0
[ 3.607704] ksys_read+0x5e/0xe0
[ 3.607704] do_syscall_64+0x3f/0x90
[ 3.607704] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 3.607704] RIP: 0033:0x7fbd49a25992
[ 3.607704] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 4
[ 3.607704] RSP: 002b:00007ffea3fe8318 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 3.607704] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00007fbd49a25992
[ 3.607704] RDX: 0000000000000010 RSI: 00007ffea3fe83a0 RDI: 000000000000000c
[ 3.607704] RBP: 000000000000000c R08: 3983c6a57a866072 R09: c736ebfbeb917d7e
[ 3.607704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 3.607704] R13: 0000000000000001 R14: 00007ffea3fe83a0 R15: 00005609e5454ea8
[ 3.607704] </TASK>
[ 3.607704] Modules linked in:
[ 3.607704] CR2: 000000000001cc43
[ 3.607704] ---[ end trace 0000000000000000 ]---
[ 3.607704] RIP: 0010:_raw_spin_lock+0x12/0x30
[ 3.607704] Code: 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 ff 05 dd de 1e 7e 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e9 9c 00 00 00 6
[ 3.607704] RSP: 0018:ffffc90000013d50 EFLAGS: 00000002
[ 3.607704] RAX: 0000000000000000 RBX: 0000000000000040 RCX: 0000000000000002
[ 3.607704] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 000000000001cc43
[ 3.607704] RBP: ffffc90000013dc8 R08: 00000000d6fbd601 R09: 0000000065abc912
[ 3.607704] R10: 00000000ba93b167 R11: 000000007bb5d0bf R12: 000000000001cc43
[ 3.607704] R13: 000000000001cc43 R14: 0000000000000003 R15: 0000000000000003
[ 3.607704] FS: 00007fbd4911b400(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[ 3.607704] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.607704] CR2: 000000000001cc43 CR3: 0000000003b42000 CR4: 00000000000006e0
[ 3.607704] note: systemd[1] exited with irqs disabled
[ 3.618556] note: systemd[1] exited with preempt_count 2
[ 3.618991] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[ 3.619797] Kernel Offset: disabled
[ 3.619798] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---
Analysis add_timer_on() found that the parameter cpu is equal to 64, which
feels strange, because qemu only specifies two CPUs, continues to look up,
and finds that the parameter cpu is obtained by
try_to_generate_entropy() -> cpumask_next().
Then use git bisect to find the bug, and find that it was introduced by
commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask optimizations"),
carefully analyzing the cpumask_next() modification record, I found that
nr_cpumask_bits modified to small_cpumask_bits, and when NR_CPUS <= BITS_PER_LONG,
small_cpumask_bits is a macro and before nr_cpumask_bits is a variable-sized.
look for find_next_bit() If no bits are set, returns @size, I seem to
understand the cause of the problem.
I fixed this bug by make `if (cpu == nr_cpumask_bits)` to `if (cpu >= nr_cpu_ids)`
At the same time I think about this situation, maybe there are the same errors
elsewhere, check it, sure enough, there are, quite a few.
The patch "random:xxx" has been verified, it is valid, the other three fixes
have not been verified, because I do not have an environment, but they
principle are same, so also submitted at the same time, if someone helps to
verify, thanks you very much.
If there is anything error, please tell me, thanks.
v2 changes:
- remove patch 5
- make nr_cpumask_bits to nr_cpu_ids
- add helper function to get next present cpu for lpfc_cpu_affinity_check
- update commit comment
v1: https://lore.kernel.org/all/[email protected]/
Vernon Yang (4):
random: fix try_to_generate_entropy() if no further cpus set
wireguard: fix wg_cpumask_choose_online() if no further cpus set
scsi: lpfc: fix lpfc_cpu_affinity_check() if no further cpus set
scsi: lpfc: fix lpfc_nvmet_setup_io_context() if no further cpus set
drivers/char/random.c | 2 +-
drivers/net/wireguard/queueing.h | 2 +-
drivers/scsi/lpfc/lpfc_init.c | 43 +++++++++++++++-----------------
drivers/scsi/lpfc/lpfc_nvmet.c | 2 +-
4 files changed, 23 insertions(+), 26 deletions(-)
--
2.34.1
When cpumask_next() the return value is greater than or equal to
nr_cpu_ids, it indicates invalid.
Before commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
optimizations"), when cpumask_next() returned an invalid cpu, the driver
used the judgment equal to nr_cpu_ids to indicate the invalid cpu, so it
happened to work normally, but this is the wrong approach.
After commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
optimizations"), these incorrect practices actively buggy, so fix it to
correctly.
Signed-off-by: Vernon Yang <[email protected]>
---
drivers/char/random.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index ce3ccd172cc8..253f2ddb8913 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1311,7 +1311,7 @@ static void __cold try_to_generate_entropy(void)
/* Basic CPU round-robin, which avoids the current CPU. */
do {
cpu = cpumask_next(cpu, &timer_cpus);
- if (cpu == nr_cpumask_bits)
+ if (cpu >= nr_cpu_ids)
cpu = cpumask_first(&timer_cpus);
} while (cpu == smp_processor_id() && num_cpus > 1);
--
2.34.1
When cpumask_next() the return value is greater than or equal to
nr_cpu_ids, it indicates invalid.
Before commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
optimizations"), when cpumask_next() returned an invalid cpu, the driver
used the judgment equal to nr_cpu_ids to indicate the invalid cpu, so it
happened to work normally, but this is the wrong approach.
After commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
optimizations"), these incorrect practices actively buggy, so fix it to
correctly.
Signed-off-by: Vernon Yang <[email protected]>
---
drivers/net/wireguard/queueing.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireguard/queueing.h b/drivers/net/wireguard/queueing.h
index 583adb37ee1e..125284b346a7 100644
--- a/drivers/net/wireguard/queueing.h
+++ b/drivers/net/wireguard/queueing.h
@@ -106,7 +106,7 @@ static inline int wg_cpumask_choose_online(int *stored_cpu, unsigned int id)
{
unsigned int cpu = *stored_cpu, cpu_index, i;
- if (unlikely(cpu == nr_cpumask_bits ||
+ if (unlikely(cpu >= nr_cpu_ids ||
!cpumask_test_cpu(cpu, cpu_online_mask))) {
cpu_index = id % cpumask_weight(cpu_online_mask);
cpu = cpumask_first(cpu_online_mask);
--
2.34.1