Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1409647
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 19/86] ring-buffer: Use long for nr_pages to avoid overflow failures |
| Date | 2016-05-31 00:10 +0200 |
| Message-ID | <rEDxM-1RI-29@gated-at.bofh.it> (permalink) |
| References | <rECs1-VP-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
commit 9b94a8fba501f38368aef6ac1b30e7335252a220 upstream.
The size variable to change the ring buffer in ftrace is a long. The
nr_pages used to update the ring buffer based on the size is int. On 64 bit
machines this can cause an overflow problem.
For example, the following will cause the ring buffer to crash:
# cd /sys/kernel/debug/tracing
# echo 10 > buffer_size_kb
# echo 8556384240 > buffer_size_kb
Then you get the warning of:
WARNING: CPU: 1 PID: 318 at kernel/trace/ring_buffer.c:1527 rb_update_pages+0x22f/0x260
Which is:
RB_WARN_ON(cpu_buffer, nr_removed);
Note each ring buffer page holds 4080 bytes.
This is because:
1) 10 causes the ring buffer to have 3 pages.
(10kb requires 3 * 4080 pages to hold)
2) (2^31 / 2^10 + 1) * 4080 = 8556384240
The value written into buffer_size_kb is shifted by 10 and then passed
to ring_buffer_resize(). 8556384240 * 2^10 = 8761737461760
3) The size passed to ring_buffer_resize() is then divided by BUF_PAGE_SIZE
which is 4080. 8761737461760 / 4080 = 2147484672
4) nr_pages is subtracted from the current nr_pages (3) and we get:
2147484669. This value is saved in a signed integer nr_pages_to_update
5) 2147484669 is greater than 2^31 but smaller than 2^32, a signed int
turns into the value of -2147482627
6) As the value is a negative number, in update_pages_handler() it is
negated and passed to rb_remove_pages() and 2147482627 pages will
be removed, which is much larger than 3 and it causes the warning
because not all the pages asked to be removed were removed.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=118001
Fixes: 7a8e76a3829f1 ("tracing: unified trace buffer")
Reported-by: Hao Qin <QEver.cn@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -437,7 +437,7 @@ struct ring_buffer_per_cpu {
raw_spinlock_t reader_lock; /* serialize readers */
arch_spinlock_t lock;
struct lock_class_key lock_key;
- unsigned int nr_pages;
+ unsigned long nr_pages;
unsigned int current_context;
struct list_head *pages;
struct buffer_page *head_page; /* read from head */
@@ -458,7 +458,7 @@ struct ring_buffer_per_cpu {
u64 write_stamp;
u64 read_stamp;
/* ring buffer pages to update, > 0 to add, < 0 to remove */
- int nr_pages_to_update;
+ long nr_pages_to_update;
struct list_head new_pages; /* new pages to add */
struct work_struct update_pages_work;
struct completion update_done;
@@ -1137,10 +1137,10 @@ static int rb_check_pages(struct ring_bu
return 0;
}
-static int __rb_allocate_pages(int nr_pages, struct list_head *pages, int cpu)
+static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu)
{
- int i;
struct buffer_page *bpage, *tmp;
+ long i;
for (i = 0; i < nr_pages; i++) {
struct page *page;
@@ -1177,7 +1177,7 @@ free_pages:
}
static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer,
- unsigned nr_pages)
+ unsigned long nr_pages)
{
LIST_HEAD(pages);
@@ -1202,7 +1202,7 @@ static int rb_allocate_pages(struct ring
}
static struct ring_buffer_per_cpu *
-rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu)
+rb_allocate_cpu_buffer(struct ring_buffer *buffer, long nr_pages, int cpu)
{
struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_page *bpage;
@@ -1302,8 +1302,9 @@ struct ring_buffer *__ring_buffer_alloc(
struct lock_class_key *key)
{
struct ring_buffer *buffer;
+ long nr_pages;
int bsize;
- int cpu, nr_pages;
+ int cpu;
/* keep it in its own cache line */
buffer = kzalloc(ALIGN(sizeof(*buffer), cache_line_size()),
@@ -1429,12 +1430,12 @@ static inline unsigned long rb_page_writ
}
static int
-rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages)
+rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
{
struct list_head *tail_page, *to_remove, *next_page;
struct buffer_page *to_remove_page, *tmp_iter_page;
struct buffer_page *last_page, *first_page;
- unsigned int nr_removed;
+ unsigned long nr_removed;
unsigned long head_bit;
int page_entries;
@@ -1651,7 +1652,7 @@ int ring_buffer_resize(struct ring_buffe
int cpu_id)
{
struct ring_buffer_per_cpu *cpu_buffer;
- unsigned nr_pages;
+ unsigned long nr_pages;
int cpu, err = 0;
/*
@@ -4645,8 +4646,9 @@ static int rb_cpu_notify(struct notifier
struct ring_buffer *buffer =
container_of(self, struct ring_buffer, cpu_notify);
long cpu = (long)hcpu;
- int cpu_i, nr_pages_same;
- unsigned int nr_pages;
+ long nr_pages_same;
+ int cpu_i;
+ unsigned long nr_pages;
switch (action) {
case CPU_UP_PREPARE:
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 00/86] 4.4.12-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 83/86] hpfs: implement the show_options method Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 80/86] SIGNAL: Move generic copy_siginfo() to signal.h Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 70/86] serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 63/86] tty: vt, return error when con_startup fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 54/86] USB: leave LPM alone if possible when binding/unbinding interface drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 75/86] ALSA: hda - Fix headphone noise on Dell XPS 13 9360 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 73/86] mcb: Fixed bar number assignment for the gdd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 77/86] ALSA: hda - Fix headset mic detection problem for one Dell machine Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 78/86] IB/srp: Fix a debug kernel crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
[PATCH 4.4 01/86] Btrfs: dont use src fd for printk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:10 +0200
[PATCH 4.4 49/86] USB: serial: option: add more ZTE device ids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:10 +0200
[PATCH 4.4 86/86] kbuild: move -Wunused-const-variable to W=1 warning level Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:20 +0200
[PATCH 4.4 55/86] usb: gadget: udc: core: Fix argument of dev_err() in usb_gadget_map_request() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:50 +0200
[PATCH 4.4 02/86] perf/x86/intel/pt: Generate PMI in the STOP region as well Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 47/86] USB: serial: io_edgeport: fix memory leaks in probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 11/86] arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 43/86] USB: serial: mxuport: fix use-after-free in probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 42/86] mei: bus: call mei_cl_read_start under device lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 46/86] USB: serial: io_edgeport: fix memory leaks in attach error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 51/86] usb: gadget: f_fs: Fix EFAULT generation for async read operations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 45/86] USB: serial: quatech2: fix use-after-free in probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 41/86] mei: amthif: discard not read messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
[PATCH 4.4 31/86] mmc: mmc: Fix partition switch timeout for some eMMCs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 15/86] fs/cifs: correctly to anonymous authentication for the LANMAN authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 29/86] irqchip/gic-v3: Configure all interrupts as non-secure Group-1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 06/86] arm64: Fix typo in the pmdp_huge_get_and_clear() definition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 13/86] remove directory incorrectly tries to set delete on close on non-empty directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 32/86] mmc: sdhci-acpi: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 19/86] ring-buffer: Use long for nr_pages to avoid overflow failures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 03/86] perf/core: Fix perf_event_open() vs. execve() race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 20/86] ring-buffer: Prevent overflow of size in ring_buffer_resize() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 28/86] irqchip/gic: Ensure ordering between read of INTACK and shared data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 05/86] ext4: iterate over buffer heads correctly in move_extent_per_page() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 12/86] kvm: arm64: Fix EC field in inject_abt64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 09/86] arm64: Implement pmdp_set_access_flags() for hardware AF/DBM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 07/86] arm64: Ensure pmd_present() returns false after pmd_mknotpresent() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 36/86] mmc: sdhci-pci: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 16/86] fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 33/86] ACPI / osi: Fix an issue that acpi_osi=!* cannot disable ACPICA internal strings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 18/86] asix: Fix offset calculation in asix_rx_fixup() causing slow transmissions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 23/86] crypto: sun4i-ss - Replace spinlock_bh by spin_lock_irq{save|restore} Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 38/86] Bluetooth: vhci: purge unhandled skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 27/86] Input: pwm-beeper - fix - scheduling while atomic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 30/86] can: fix handling of unmodifiable configuration options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 17/86] fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 10/86] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 24/86] clk: qcom: msm8916: Fix crypto clock flags Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 14/86] fs/cifs: correctly to anonymous authentication via NTLMSSP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 22/86] crypto: talitos - fix ahash algorithms registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 08/86] arm64: Implement ptep_set_access_flags() for hardware AF/DBM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
[PATCH 4.4 26/86] mfd: omap-usb-tll: Fix scheduling while atomic BUG Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
Re: [PATCH 4.4 00/86] 4.4.12-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-01 16:30 +0200
csiph-web