Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759722AbcCDSli (ORCPT ); Fri, 4 Mar 2016 13:41:38 -0500 Received: from mx2.suse.de ([195.135.220.15]:45552 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758357AbcCDSlh (ORCPT ); Fri, 4 Mar 2016 13:41:37 -0500 Date: Fri, 4 Mar 2016 10:41:28 -0800 From: Davidlohr Bueso To: Kefeng Wang Cc: paulmck@linux.vnet.ibm.com, linux-kernel@vger.kernel.org, peterz@infradead.org, mingo@redhat.com, Josh Triplett , "Guohanjun (Hanjun Guo)" Subject: Re: [PATCH v2] locktorture: Fix NULL pointer when torture_type is invalid Message-ID: <20160304184128.GA21739@linux-uzut.site> References: <56AEC21A.5010107@huawei.com> <20160201030235.GC16147@linux-uzut.site> <56AED0C7.7050505@huawei.com> <20160202064635.GH6719@linux.vnet.ibm.com> <20160203002331.GA3385@linux-uzut.site> <20160302195543.GA12593@linux-uzut.site> <20160302211216.GC3577@linux.vnet.ibm.com> <56D79566.7010302@huawei.com> <56D7BE33.5010605@huawei.com> <20160303083626.GA10957@linux-uzut.site> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <20160303083626.GA10957@linux-uzut.site> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3816 Lines: 80 >The below should take care of both issues, what do you think? fyi I've found another issue, completely unrelated to this one. We can deref a nil ptr in the rtmutex torturing, which I hit last night. ><8------------------------------------------------------------------------- >Subject: [PATCH] locktorture: Fix nil pointer dereferencing for cleanup paths Paul, so we would need this patch, assuming Kefeng is good with it (if so could you please add a reported/tested-by tag?). As well as this next one, unless you have any problems with the fix obviously. Thanks, Davidlohr ----8<-------------------------------------------------------------------- Subject: [PATCH] locktorture: Fix deboosting nil ptr dereferencing For the case of rtmutex torturing we will randomly call into the boost() handler, including upon module exiting when the tasks are deboosted before stopping. In such cases the task may or may not have already been boosted, and therefore the NULL being explicitly passed can occur anywhere. Currently we only assume that the task will is at a higher prio, and in consequence, dereference a nil pointer. This patch fixes the case of a rmmod locktorture exploding while pounding on the rtmutex lock (partial trace): [83317.452251] task: ffff88081026cf80 ti: ffff880816120000 task.ti: ffff880816120000 [83317.452258] RIP: 0010:[] [] torture_random+0x5/0x60 [torture] [83317.452261] RSP: 0018:ffff880816123eb0 EFLAGS: 00010206 [83317.452264] RAX: ffff88081026cf80 RBX: ffff880816bfa630 RCX: 0000000000160d1b [83317.452267] RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000 [83317.452269] RBP: ffff88081026cf80 R08: 000000000000001f R09: ffff88017c20ca80 [83317.452271] R10: 0000000000000000 R11: 000000000048c316 R12: ffffffffa05d1840 [83317.452273] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [83317.452275] FS: 0000000000000000(0000) GS:ffff88203f880000(0000) knlGS:0000000000000000 [83317.452277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83317.452279] CR2: 0000000000000008 CR3: 0000000001c0a000 CR4: 00000000000406e0 [83317.452281] Stack: [83317.452288] ffffffffa05d141d ffff880816bfa630 ffffffffa05d1922 ffff88081e70c2c0 [83317.452295] ffff880816bfa630 ffffffff81095fed 0000000000000000 ffffffff8107bf60 [83317.452297] ffff880816bfa630 ffffffff00000000 ffff880800000000 ffff880816123f08 [83317.452297] Call Trace: [83317.452309] [] torture_rtmutex_boost+0x1d/0x90 [locktorture] [83317.452315] [] lock_torture_writer+0xe2/0x170 [locktorture] [83317.452321] [] kthread+0xbd/0xe0 [83317.452325] [] ret_from_fork+0x3f/0x70 This patch ensures that if the random state pointer is not nil and current is not boosted, then do nothing. Signed-off-by: Davidlohr Bueso --- kernel/locking/locktorture.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c index 8ef1919..9e9c5f4 100644 --- a/kernel/locking/locktorture.c +++ b/kernel/locking/locktorture.c @@ -394,12 +394,12 @@ static void torture_rtmutex_boost(struct torture_random_state *trsp) if (!rt_task(current)) { /* - * (1) Boost priority once every ~50k operations. When the + * Boost priority once every ~50k operations. When the * task tries to take the lock, the rtmutex it will account * for the new priority, and do any corresponding pi-dance. */ - if (!(torture_random(trsp) % - (cxt.nrealwriters_stress * factor))) { + if (trsp && !(torture_random(trsp) % + (cxt.nrealwriters_stress * factor))) { policy = SCHED_FIFO; param.sched_priority = MAX_RT_PRIO - 1; } else /* common case, do nothing */ -- 2.1.4