Revision e91467ecd1ef381377fd327c0ded922835ec52ab authored by Christian Borntraeger on 05 August 2006, 19:13:52 UTC, committed by Linus Torvalds on 06 August 2006, 15:57:46 UTC
This patch adds a barrier() in futex unqueue_me to avoid aliasing of two
pointers.

On my s390x system I saw the following oops:

Unable to handle kernel pointer dereference at virtual kernel address
0000000000000000
Oops: 0004 [#1]
CPU:    0    Not tainted
Process mytool (pid: 13613, task: 000000003ecb6ac0, ksp: 00000000366bdbd8)
Krnl PSW : 0704d00180000000 00000000003c9ac2 (_spin_lock+0xe/0x30)
Krnl GPRS: 00000000ffffffff 000000003ecb6ac0 0000000000000000 0700000000000000
           0000000000000000 0000000000000000 000001fe00002028 00000000000c091f
           000001fe00002054 000001fe00002054 0000000000000000 00000000366bddc0
           00000000005ef8c0 00000000003d00e8 0000000000144f91 00000000366bdcb8
Krnl Code: ba 4e 20 00 12 44 b9 16 00 3e a7 84 00 08 e3 e0 f0 88 00 04
Call Trace:
([<0000000000144f90>] unqueue_me+0x40/0xe4)
 [<0000000000145a0c>] do_futex+0x33c/0xc40
 [<000000000014643e>] sys_futex+0x12e/0x144
 [<000000000010bb00>] sysc_noemu+0x10/0x16
 [<000002000003741c>] 0x2000003741c

The code in question is:

static int unqueue_me(struct futex_q *q)
{
        int ret = 0;
        spinlock_t *lock_ptr;

        /* In the common case we don't take the spinlock, which is nice. */
 retry:
        lock_ptr = q->lock_ptr;
        if (lock_ptr != 0) {
                spin_lock(lock_ptr);
		/*
                 * q->lock_ptr can change between reading it and
                 * spin_lock(), causing us to take the wrong lock.  This
                 * corrects the race condition.
[...]

and my compiler (gcc 4.1.0) makes the following out of it:

00000000000003c8 <unqueue_me>:
     3c8:       eb bf f0 70 00 24       stmg    %r11,%r15,112(%r15)
     3ce:       c0 d0 00 00 00 00       larl    %r13,3ce <unqueue_me+0x6>
                        3d0: R_390_PC32DBL      .rodata+0x2a
     3d4:       a7 f1 1e 00             tml     %r15,7680
     3d8:       a7 84 00 01             je      3da <unqueue_me+0x12>
     3dc:       b9 04 00 ef             lgr     %r14,%r15
     3e0:       a7 fb ff d0             aghi    %r15,-48
     3e4:       b9 04 00 b2             lgr     %r11,%r2
     3e8:       e3 e0 f0 98 00 24       stg     %r14,152(%r15)
     3ee:       e3 c0 b0 28 00 04       lg      %r12,40(%r11)
		/* write q->lock_ptr in r12 */
     3f4:       b9 02 00 cc             ltgr    %r12,%r12
     3f8:       a7 84 00 4b             je      48e <unqueue_me+0xc6>
		/* if r12 is zero then jump over the code.... */
     3fc:       e3 20 b0 28 00 04       lg      %r2,40(%r11)
		/* write q->lock_ptr in r2 */
     402:       c0 e5 00 00 00 00       brasl   %r14,402 <unqueue_me+0x3a>
                        404: R_390_PC32DBL      _spin_lock+0x2
		/* use r2 as parameter for spin_lock */

So the code becomes more or less:
if (q->lock_ptr != 0) spin_lock(q->lock_ptr)
instead of
if (lock_ptr != 0) spin_lock(lock_ptr)

Which caused the oops from above.
After adding a barrier gcc creates code without this problem:
[...] (the same)
     3ee:       e3 c0 b0 28 00 04       lg      %r12,40(%r11)
     3f4:       b9 02 00 cc             ltgr    %r12,%r12
     3f8:       b9 04 00 2c             lgr     %r2,%r12
     3fc:       a7 84 00 48             je      48c <unqueue_me+0xc4>
     400:       c0 e5 00 00 00 00       brasl   %r14,400 <unqueue_me+0x38>
                        402: R_390_PC32DBL      _spin_lock+0x2

As a general note, this code of unqueue_me seems a bit fishy. The retry logic
of unqueue_me only works if we can guarantee, that the original value of
q->lock_ptr is always a spinlock (Otherwise we overwrite kernel memory). We
know that q->lock_ptr can change. I dont know what happens with the original
spinlock, as I am not an expert with the futex code.

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Acked-by: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@timesys.com>
Signed-off-by: Christian Borntraeger <borntrae@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1 parent 72f0b4e
Raw File
err_ev7.h
#ifndef __ALPHA_ERR_EV7_H
#define __ALPHA_ERR_EV7_H 1

/*
 * Data for el packet class PAL (14), type LOGOUT_FRAME (1)
 */
struct ev7_pal_logout_subpacket {
	u32 mchk_code;
	u32 subpacket_count;
	u64 whami;
	u64 rbox_whami;
	u64 rbox_int;
	u64 exc_addr;
	union el_timestamp timestamp;
	u64 halt_code;
	u64 reserved;
};

/*
 * Data for el packet class PAL (14), type EV7_PROCESSOR (4)
 */
struct ev7_pal_processor_subpacket {
	u64 i_stat;
	u64 dc_stat;
	u64 c_addr;
	u64 c_syndrome_1;
	u64 c_syndrome_0;
	u64 c_stat;
	u64 c_sts;
	u64 mm_stat;
	u64 exc_addr;
	u64 ier_cm;
	u64 isum;
	u64 pal_base;
	u64 i_ctl;
	u64 process_context;
	u64 cbox_ctl;
	u64 cbox_stp_ctl;
	u64 cbox_acc_ctl;
	u64 cbox_lcl_set;
	u64 cbox_gbl_set;
	u64 bbox_ctl;
	u64 bbox_err_sts;
	u64 bbox_err_idx;
	u64 cbox_ddp_err_sts;
	u64 bbox_dat_rmp;
	u64 reserved[2];
};

/*
 * Data for el packet class PAL (14), type EV7_ZBOX (5)
 */
struct ev7_pal_zbox_subpacket {
	u32 zbox0_dram_err_status_1;
	u32 zbox0_dram_err_status_2;
	u32 zbox0_dram_err_status_3;
	u32 zbox0_dram_err_ctl;
	u32 zbox0_dram_err_adr;
	u32 zbox0_dift_timeout;
	u32 zbox0_dram_mapper_ctl;
	u32 zbox0_frc_err_adr;
	u32 zbox0_dift_err_status;
	u32 reserved1;
	u32 zbox1_dram_err_status_1;
	u32 zbox1_dram_err_status_2;
	u32 zbox1_dram_err_status_3;
	u32 zbox1_dram_err_ctl;
	u32 zbox1_dram_err_adr;
	u32 zbox1_dift_timeout;
	u32 zbox1_dram_mapper_ctl;
	u32 zbox1_frc_err_adr;
	u32 zbox1_dift_err_status;
	u32 reserved2;
	u64 cbox_ctl;
	u64 cbox_stp_ctl;
	u64 zbox0_error_pa;
	u64 zbox1_error_pa;
	u64 zbox0_ored_syndrome;
	u64 zbox1_ored_syndrome;
	u64 reserved3[2];
};

/*
 * Data for el packet class PAL (14), type EV7_RBOX (6)
 */
struct ev7_pal_rbox_subpacket {
	u64 rbox_cfg;
	u64 rbox_n_cfg;
	u64 rbox_s_cfg;
	u64 rbox_e_cfg;
	u64 rbox_w_cfg;
	u64 rbox_n_err;
	u64 rbox_s_err;
	u64 rbox_e_err;
	u64 rbox_w_err;
	u64 rbox_io_cfg;
	u64 rbox_io_err;
	u64 rbox_l_err;
	u64 rbox_whoami;
	u64 rbox_imask;
	u64 rbox_intq;
	u64 rbox_int;
	u64 reserved[2];
};

/*
 * Data for el packet class PAL (14), type EV7_IO (7)
 */
struct ev7_pal_io_one_port {
	u64 pox_err_sum;
	u64 pox_tlb_err;
	u64 pox_spl_cmplt;
	u64 pox_trans_sum;
	u64 pox_first_err;
	u64 pox_mult_err;
	u64 pox_dm_source;
	u64 pox_dm_dest;
	u64 pox_dm_size;
	u64 pox_dm_ctrl;
	u64 reserved;
};

struct ev7_pal_io_subpacket {
	u64 io_asic_rev;
	u64 io_sys_rev;
	u64 io7_uph;
	u64 hpi_ctl;
	u64 crd_ctl;
	u64 hei_ctl;
	u64 po7_error_sum;
	u64 po7_uncrr_sym;
	u64 po7_crrct_sym;
	u64 po7_ugbge_sym;
	u64 po7_err_pkt0;
	u64 po7_err_pkt1;
	u64 reserved[2];
	struct ev7_pal_io_one_port ports[4];
};

/*
 * Environmental subpacket. Data used for el packets:
 * 	   class PAL (14), type AMBIENT_TEMPERATURE (10)
 * 	   class PAL (14), type AIRMOVER_FAN (11)
 * 	   class PAL (14), type VOLTAGE (12)
 * 	   class PAL (14), type INTRUSION (13)
 *	   class PAL (14), type POWER_SUPPLY (14)
 *	   class PAL (14), type LAN (15)
 *	   class PAL (14), type HOT_PLUG (16)
 */
struct ev7_pal_environmental_subpacket {
	u16 cabinet;
	u16 drawer;
	u16 reserved1[2];
	u8 module_type;
	u8 unit_id;		/* unit reporting condition */
	u8 reserved2;
	u8 condition;		/* condition reported       */
};

/*
 * Convert environmental type to index
 */
static inline int ev7_lf_env_index(int type)
{
	BUG_ON((type < EL_TYPE__PAL__ENV__AMBIENT_TEMPERATURE) 
	       || (type > EL_TYPE__PAL__ENV__HOT_PLUG));

	return type - EL_TYPE__PAL__ENV__AMBIENT_TEMPERATURE;
}

/*
 * Data for generic el packet class PAL.
 */
struct ev7_pal_subpacket {
	union {
		struct ev7_pal_logout_subpacket logout;	     /* Type     1 */
		struct ev7_pal_processor_subpacket ev7;	     /* Type     4 */
		struct ev7_pal_zbox_subpacket zbox;	     /* Type     5 */
		struct ev7_pal_rbox_subpacket rbox;	     /* Type     6 */
		struct ev7_pal_io_subpacket io;		     /* Type     7 */
		struct ev7_pal_environmental_subpacket env;  /* Type 10-16 */
		u64 as_quad[1];				     /* Raw u64    */
	} by_type;
};

/*
 * Struct to contain collected logout from subpackets.
 */
struct ev7_lf_subpackets {
	struct ev7_pal_logout_subpacket *logout;		/* Type  1 */
	struct ev7_pal_processor_subpacket *ev7;		/* Type  4 */
	struct ev7_pal_zbox_subpacket *zbox;			/* Type  5 */
	struct ev7_pal_rbox_subpacket *rbox;			/* Type  6 */
	struct ev7_pal_io_subpacket *io;			/* Type  7 */
	struct ev7_pal_environmental_subpacket *env[7];	     /* Type 10-16 */

	unsigned int io_pid;
};

#endif /* __ALPHA_ERR_EV7_H */


back to top