Hello,
I updated the Linux kernel to commit fe15c26ee26e ("Linux 6.3-rc1")
and found that when the system boots to systemd ranom initialization,
panic, as follows:
[ 3.607299] BUG: unable to handle page fault for address: 000000000001cc43
[ 3.607558] #PF: supervisor read access in kernel mode
[ 3.607704] #PF: error_code(0x0000) - not-present page
[ 3.607704] PGD 0 P4D 0
[ 3.607704] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 3.607704] CPU: 1 PID: 1 Comm: systemd Not tainted 6.3.0-rc1 #50
[ 3.607704] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 3.607704] RIP: 0010:_raw_spin_lock+0x12/0x30
[ 3.607704] Code: 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 ff 05 dd de 1e 7e 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e9 9c 00 00 00 6
[ 3.607704] RSP: 0018:ffffc90000013d50 EFLAGS: 00000002
[ 3.607704] RAX: 0000000000000000 RBX: 0000000000000040 RCX: 0000000000000002
[ 3.607704] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 000000000001cc43
[ 3.607704] RBP: ffffc90000013dc8 R08: 00000000d6fbd601 R09: 0000000065abc912
[ 3.607704] R10: 00000000ba93b167 R11: 000000007bb5d0bf R12: 000000000001cc43
[ 3.607704] R13: 000000000001cc43 R14: 0000000000000003 R15: 0000000000000003
[ 3.607704] FS: 00007fbd4911b400(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[ 3.607704] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.607704] CR2: 000000000001cc43 CR3: 0000000003b42000 CR4: 00000000000006e0
[ 3.607704] Call Trace:
[ 3.607704] <TASK>
[ 3.607704] add_timer_on+0x80/0x130
[ 3.607704] try_to_generate_entropy+0x246/0x270
[ 3.607704] ? do_filp_open+0xb1/0x160
[ 3.607704] ? __pfx_entropy_timer+0x10/0x10
[ 3.607704] ? inode_security+0x1d/0x60
[ 3.607704] urandom_read_iter+0x23/0x90
[ 3.607704] vfs_read+0x203/0x2d0
[ 3.607704] ksys_read+0x5e/0xe0
[ 3.607704] do_syscall_64+0x3f/0x90
[ 3.607704] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 3.607704] RIP: 0033:0x7fbd49a25992
[ 3.607704] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 4
[ 3.607704] RSP: 002b:00007ffea3fe8318 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 3.607704] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00007fbd49a25992
[ 3.607704] RDX: 0000000000000010 RSI: 00007ffea3fe83a0 RDI: 000000000000000c
[ 3.607704] RBP: 000000000000000c R08: 3983c6a57a866072 R09: c736ebfbeb917d7e
[ 3.607704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 3.607704] R13: 0000000000000001 R14: 00007ffea3fe83a0 R15: 00005609e5454ea8
[ 3.607704] </TASK>
[ 3.607704] Modules linked in:
[ 3.607704] CR2: 000000000001cc43
[ 3.607704] ---[ end trace 0000000000000000 ]---
[ 3.607704] RIP: 0010:_raw_spin_lock+0x12/0x30
[ 3.607704] Code: 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 ff 05 dd de 1e 7e 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e9 9c 00 00 00 6
[ 3.607704] RSP: 0018:ffffc90000013d50 EFLAGS: 00000002
[ 3.607704] RAX: 0000000000000000 RBX: 0000000000000040 RCX: 0000000000000002
[ 3.607704] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 000000000001cc43
[ 3.607704] RBP: ffffc90000013dc8 R08: 00000000d6fbd601 R09: 0000000065abc912
[ 3.607704] R10: 00000000ba93b167 R11: 000000007bb5d0bf R12: 000000000001cc43
[ 3.607704] R13: 000000000001cc43 R14: 0000000000000003 R15: 0000000000000003
[ 3.607704] FS: 00007fbd4911b400(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[ 3.607704] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.607704] CR2: 000000000001cc43 CR3: 0000000003b42000 CR4: 00000000000006e0
[ 3.607704] note: systemd[1] exited with irqs disabled
[ 3.618556] note: systemd[1] exited with preempt_count 2
[ 3.618991] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[ 3.619797] Kernel Offset: disabled
[ 3.619798] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---
Analysis add_timer_on() found that the parameter cpu is equal to 64, which
feels strange, because qemu only specifies two CPUs, continues to look up,
and finds that the parameter cpu is obtained by
try_to_generate_entropy() -> cpumask_next().
Then use git bisect to find the bug, and find that it was introduced by
commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask optimizations"),
carefully analyzing the cpumask_next() modification record, I found that
nr_cpumask_bits modified to small_cpumask_bits, and when NR_CPUS <= BITS_PER_LONG,
small_cpumask_bits is a macro and before nr_cpumask_bits is a variable-sized.
look for find_next_bit() If no bits are set, returns @size, I seem to
understand the cause of the problem.
I fixed this bug by make `if (cpu == nr_cpumask_bits)` to `if (cpu >= nr_cpumask_bits)`
At the same time I think about this situation, maybe there are the same errors
elsewhere, check it, sure enough, there are, quite a few.
The patch "random:xxx" has been verified, it is valid, the other three fixes
have not been verified, because I do not have an environment, but they
principle are same, so also submitted at the same time, if someone helps to
verify, thanks you very much.
If there is anything error, please tell me, thanks.
Vernon Yang (5):
random: fix try_to_generate_entropy() if no further cpus set
wireguard: fix wg_cpumask_choose_online() if no further cpus set
scsi: lpfc: fix lpfc_cpu_affinity_check() if no further cpus set
scsi: lpfc: fix lpfc_nvmet_setup_io_context() if no further cpus set
cpumask: fix comment of cpumask_xxx
drivers/char/random.c | 2 +-
drivers/net/wireguard/queueing.h | 2 +-
drivers/scsi/lpfc/lpfc_init.c | 14 +++++-----
drivers/scsi/lpfc/lpfc_nvmet.c | 2 +-
include/linux/cpumask.h | 46 ++++++++++++++++----------------
5 files changed, 33 insertions(+), 33 deletions(-)
--
2.34.1
After commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
optimizations"), when NR_CPUS <= BITS_PER_LONG, small_cpumask_bits used
a macro instead of variable-sized for efficient.
If no further cpus set, the cpumask_next() returns small_cpumask_bits,
it must greater than or equal to nr_cpumask_bits, so fix it to correctly.
Signed-off-by: Vernon Yang <[email protected]>
---
drivers/net/wireguard/queueing.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireguard/queueing.h b/drivers/net/wireguard/queueing.h
index 583adb37ee1e..41adeac3ee0b 100644
--- a/drivers/net/wireguard/queueing.h
+++ b/drivers/net/wireguard/queueing.h
@@ -106,7 +106,7 @@ static inline int wg_cpumask_choose_online(int *stored_cpu, unsigned int id)
{
unsigned int cpu = *stored_cpu, cpu_index, i;
- if (unlikely(cpu == nr_cpumask_bits ||
+ if (unlikely(cpu >= nr_cpumask_bits ||
!cpumask_test_cpu(cpu, cpu_online_mask))) {
cpu_index = id % cpumask_weight(cpu_online_mask);
cpu = cpumask_first(cpu_online_mask);
--
2.34.1
After commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
optimizations"), when NR_CPUS <= BITS_PER_LONG, small_cpumask_bits used
a macro instead of variable-sized for efficient.
If no further cpus set, the cpumask_next() returns small_cpumask_bits,
it must greater than or equal to nr_cpumask_bits, so fix it to correctly.
Signed-off-by: Vernon Yang <[email protected]>
---
drivers/scsi/lpfc/lpfc_init.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 61958a24a43d..01c0e2f47cf7 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -12563,7 +12563,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
goto found_same;
new_cpu = cpumask_next(
new_cpu, cpu_present_mask);
- if (new_cpu == nr_cpumask_bits)
+ if (new_cpu >= nr_cpumask_bits)
new_cpu = first_cpu;
}
/* At this point, we leave the CPU as unassigned */
@@ -12577,7 +12577,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
* selecting the same IRQ.
*/
start_cpu = cpumask_next(new_cpu, cpu_present_mask);
- if (start_cpu == nr_cpumask_bits)
+ if (start_cpu >= nr_cpumask_bits)
start_cpu = first_cpu;
lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
@@ -12613,7 +12613,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
goto found_any;
new_cpu = cpumask_next(
new_cpu, cpu_present_mask);
- if (new_cpu == nr_cpumask_bits)
+ if (new_cpu >= nr_cpumask_bits)
new_cpu = first_cpu;
}
/* We should never leave an entry unassigned */
@@ -12631,7 +12631,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
* selecting the same IRQ.
*/
start_cpu = cpumask_next(new_cpu, cpu_present_mask);
- if (start_cpu == nr_cpumask_bits)
+ if (start_cpu >= nr_cpumask_bits)
start_cpu = first_cpu;
lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
@@ -12704,7 +12704,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
goto found_hdwq;
}
new_cpu = cpumask_next(new_cpu, cpu_present_mask);
- if (new_cpu == nr_cpumask_bits)
+ if (new_cpu >= nr_cpumask_bits)
new_cpu = first_cpu;
}
@@ -12719,7 +12719,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
goto found_hdwq;
new_cpu = cpumask_next(new_cpu, cpu_present_mask);
- if (new_cpu == nr_cpumask_bits)
+ if (new_cpu >= nr_cpumask_bits)
new_cpu = first_cpu;
}
@@ -12730,7 +12730,7 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
found_hdwq:
/* We found an available entry, copy the IRQ info */
start_cpu = cpumask_next(new_cpu, cpu_present_mask);
- if (start_cpu == nr_cpumask_bits)
+ if (start_cpu >= nr_cpumask_bits)
start_cpu = first_cpu;
cpup->hdwq = new_cpup->hdwq;
logit:
--
2.34.1
After commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
optimizations"), when NR_CPUS <= BITS_PER_LONG, small_cpumask_bits used
a macro instead of variable-sized for efficient.
If no further cpus set, the cpumask_next() returns small_cpumask_bits,
it must greater than or equal to nr_cpumask_bits, so fix it to correctly.
Signed-off-by: Vernon Yang <[email protected]>
---
drivers/char/random.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index ce3ccd172cc8..d76f12a5f74f 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1311,7 +1311,7 @@ static void __cold try_to_generate_entropy(void)
/* Basic CPU round-robin, which avoids the current CPU. */
do {
cpu = cpumask_next(cpu, &timer_cpus);
- if (cpu == nr_cpumask_bits)
+ if (cpu >= nr_cpumask_bits)
cpu = cpumask_first(&timer_cpus);
} while (cpu == smp_processor_id() && num_cpus > 1);
--
2.34.1
On Tue, Mar 07, 2023 at 12:06:47AM +0800, Vernon Yang wrote:
> After commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask
> optimizations"), when NR_CPUS <= BITS_PER_LONG, small_cpumask_bits used
> a macro instead of variable-sized for efficient.
>
> If no further cpus set, the cpumask_next() returns small_cpumask_bits,
> it must greater than or equal to nr_cpumask_bits, so fix it to correctly.
>
> Signed-off-by: Vernon Yang <[email protected]>
Hi Vernon,
In all that cases, nr_cpu_ids must be used. The difference is that
nr_cpumask_bits is an upper limit for possible CPUs, and it's derived
from compile-time NR_CPUS, unless CPUMASK_OFFSTACK is enabled.
nr_cpu_ids is an actual number of CPUS as counted on boot.
So, nr_cpu_ids is always equal or less than nr_cpumask_bits, and we'd
compare with the smaller number.
Nor sure, but maybe it's worth to introduce a macro like:
#define valid_cpuid(cpu) (cpu) < nr_cpu_ids
Thanks,
Yury
> ---
> drivers/char/random.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/char/random.c b/drivers/char/random.c
> index ce3ccd172cc8..d76f12a5f74f 100644
> --- a/drivers/char/random.c
> +++ b/drivers/char/random.c
> @@ -1311,7 +1311,7 @@ static void __cold try_to_generate_entropy(void)
> /* Basic CPU round-robin, which avoids the current CPU. */
> do {
> cpu = cpumask_next(cpu, &timer_cpus);
> - if (cpu == nr_cpumask_bits)
> + if (cpu >= nr_cpumask_bits)
> cpu = cpumask_first(&timer_cpus);
> } while (cpu == smp_processor_id() && num_cpus > 1);
>
> --
> 2.34.1
On Mon, Mar 6, 2023 at 8:07 AM Vernon Yang <[email protected]> wrote:
>
> - if (new_cpu == nr_cpumask_bits)
> + if (new_cpu >= nr_cpumask_bits)
This all should use "nr_cpu_ids", not "nr_cpumask_bits".
But I really suspect that it should all be rewritten to not do that
thing over and over, but just use a helper function for it.
int lpfc_next_present_cpu(int n, int alternate)
{
n = cpumask_next(n, cpu_present_mask);
if (n >= nr_cpu_ids)
n = alternate;
return n;
}
and then you could just use
start_cpu = lpfc_next_present_cpu(new_cpu, first_cpu);
or similar.
Linus
PS. We "kind of" already have a helper function for this:
cpumask_next_wrap(). But it's really meant for a different pattern
entirely, so let's not confuse things.
On Mon, Mar 06, 2023 at 10:48:04AM -0800, Linus Torvalds wrote:
> On Mon, Mar 6, 2023 at 8:07 AM Vernon Yang <[email protected]> wrote:
> >
> > - if (new_cpu == nr_cpumask_bits)
> > + if (new_cpu >= nr_cpumask_bits)
>
> This all should use "nr_cpu_ids", not "nr_cpumask_bits".
>
> But I really suspect that it should all be rewritten to not do that
> thing over and over, but just use a helper function for it.
>
> int lpfc_next_present_cpu(int n, int alternate)
> {
> n = cpumask_next(n, cpu_present_mask);
> if (n >= nr_cpu_ids)
> n = alternate;
> return n;
> }
>
> and then you could just use
>
> start_cpu = lpfc_next_present_cpu(new_cpu, first_cpu);
OK, thanks you very much.
I'll send a second version shortly
>
> or similar.
>
> Linus
>
> PS. We "kind of" already have a helper function for this:
> cpumask_next_wrap(). But it's really meant for a different pattern
> entirely, so let's not confuse things.