From patchwork Fri Nov 1 23:28:28 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ivan Khoronzhuk X-Patchwork-Id: 178342 Delivered-To: patch@linaro.org Received: by 2002:a92:409a:0:0:0:0:0 with SMTP id d26csp1173118ill; Fri, 1 Nov 2019 16:28:54 -0700 (PDT) X-Google-Smtp-Source: APXvYqzIK5AyFq3J8KjfScWNLWLJlZd41KGVi6zPziH4MzkxP4Ly/JY51TEY33J+k4laQBiy9ZYN X-Received: by 2002:a17:906:4056:: with SMTP id y22mr12792006ejj.188.1572650934051; Fri, 01 Nov 2019 16:28:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1572650934; cv=none; d=google.com; s=arc-20160816; b=A6SMrxKIUys0bjt+veVlrsFxXqf6O5A+lokNRbRw1GJ1XwcJUzXcmbbrkVrFAjfkrx lUNjR+Fpb8hZ+irzSFKJjBqFMg9D1K/JALrypQ0EeY6AGYKhbYLYEVPSN2nZuJ3mg4O0 LNu1Es2s9hWGJAurFxPUxntSnfNxRNqYiO+NcJ+D5Pf1tEyAcddHt1cfOflQo7QPAYR+ vZClrq3CPHf0EWXXNcW2R95KUpfTtqSrJx4yhMauS1bAoH0gl3V+qfXg5kPgdmaRR7Do YBMms7R9TzlkZhF5FMj13I+HrWD74Vo9/MSSWfrZvnVPRFdZZZc7XM50smsqzQ7gyedT qmhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=+M1K01EEp04eNFe1/UKBDW3ZMjQPHzjlhyOmR/QFjcs=; b=HSgTVLtobwxhynw/pnT0L5FA1FkGBmwe9pMr41UMYJlyABZON8Tg2qsV5D0BQ7eN5i hH4QES5iDTBCJS5nslQqpe6Hpxs7VmXfxmlcV65onJxz1bfIgktoXxwmXHhPPifucfeg mG6ARcj1OuekjeQpf2my68FIP/WdqGxnmtrnpwqF423IMjI2wfudLjUjaPh4OqTWMChL N2oi/YoTSqVESDKk2xW6kGKbPFRiOyGbvWxazUY1T3JtAC/e4fjtpG44RymrQuNJA0u2 HUH1o9fnYLN6K8sRxTvs5vOs4aqlzwazzR0uNCiGR+g5qgzLXMeP1NLUH0CbKQrOap6Y h7Lw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=aFEY4zmp; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e50si1638881ede.59.2019.11.01.16.28.53; Fri, 01 Nov 2019 16:28:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=aFEY4zmp; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727773AbfKAX2t (ORCPT + 26 others); Fri, 1 Nov 2019 19:28:49 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:45741 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725989AbfKAX2t (ORCPT ); Fri, 1 Nov 2019 19:28:49 -0400 Received: by mail-lf1-f68.google.com with SMTP id v8so8293312lfa.12 for ; Fri, 01 Nov 2019 16:28:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=+M1K01EEp04eNFe1/UKBDW3ZMjQPHzjlhyOmR/QFjcs=; b=aFEY4zmpK64LpsuQxvdQEnFnTIeGCwrg3i2xNAwXEL2GVHLzO6dfGjoI8LFTB4x6jN kwTCNk0RMOhjlR/vV9kB96xiZcg7bdoN8hXcWciHgZT7BWgukZcWmnjyqCpB1rWgQpGQ cKcY9faYSHJEBmhlmu+HGRVKIabtDyx7R+XzG+7eQSB7XgOot37CYno7FVfwU04t3AXy llXGksOdEhsrExQMmPnxw0qYO5hmWCxyboZYISvzWsMWn7tkagKu7HvmvebsD7TpGBot Dvdh65Q4K4WitAOdFUTXgXT/HXZZmGoAsfnqEdRvxpkxK1KRAq6nj4QdU9F3S1vfyRIg +slw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=+M1K01EEp04eNFe1/UKBDW3ZMjQPHzjlhyOmR/QFjcs=; b=UDzoK1zM8vJzTOY+wJboJ3eqN9Ixpt6g+txCY+EmLjyOG+PdXAv+sgGe3OCOEMBIfA tW3tb9nORM6wF+0q4huVXeWFRRHI+SwPdA7v+s6vkeVedSKQrNLh/5BXnhNfB4fuNK5m E+vfbJ5sM9oxsvIq3d5pQdzoolnDMcZKV5bE0uvoI8pJNIvEw8+a50dqfUY9nXUZKh96 6qGPe6YcC8HislOYSlQAYpghhxPg9N4boo8v4bJuWg1NKbBX/qKni7erebqfrcmjYgm2 6sOXi1IK4u+t3DT09GHId04aRnKdsijgD/p0VlU0Q4/h/yFMqzk/UQDB9pwmS36//Nbx x+Bg== X-Gm-Message-State: APjAAAXSbuOz0/istkgZUzKjyq4lHUXVMdTKEqip1/XZBFbKAoSLE/eY 6v1Kc2bCn6KK1Pxe7O5AKBFMiw== X-Received: by 2002:a19:7d85:: with SMTP id y127mr8527754lfc.160.1572650926729; Fri, 01 Nov 2019 16:28:46 -0700 (PDT) Received: from localhost.localdomain (88-201-94-178.pool.ukrtel.net. [178.94.201.88]) by smtp.gmail.com with ESMTPSA id l21sm3355673lje.0.2019.11.01.16.28.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 Nov 2019 16:28:46 -0700 (PDT) From: Ivan Khoronzhuk To: davem@davemloft.net, vinicius.gomes@intel.com Cc: jhs@mojatatu.com, xiyou.wangcong@gmail.com, jiri@resnulli.us, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Ivan Khoronzhuk Subject: [PATCH net] taprio: fix panic while hw offload sched list swap Date: Sat, 2 Nov 2019 01:28:28 +0200 Message-Id: <20191101232828.17023-1-ivan.khoronzhuk@linaro.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Don't swap oper and admin schedules too early, it's not correct and causes crash. Steps to reproduce: 1) tc qdisc replace dev eth0 parent root handle 100 taprio \ num_tc 3 \ map 2 2 1 0 2 2 2 2 2 2 2 2 2 2 2 2 \ queues 1@0 1@1 1@2 \ base-time $SOME_BASE_TIME \ sched-entry S 01 80000 \ sched-entry S 02 15000 \ sched-entry S 04 40000 \ flags 2 2) tc qdisc replace dev eth0 parent root handle 100 taprio \ base-time $SOME_BASE_TIME \ sched-entry S 01 90000 \ sched-entry S 02 20000 \ sched-entry S 04 40000 \ flags 2 3) tc qdisc replace dev eth0 parent root handle 100 taprio \ base-time $SOME_BASE_TIME \ sched-entry S 01 150000 \ sched-entry S 02 200000 \ sched-entry S 04 40000 \ flags 2 Do 2 3 2 .. steps more times if not happens and observe: [ 305.832319] Unable to handle kernel write to read-only memory at virtual address ffff0000087ce7f0 [ 305.910887] CPU: 0 PID: 0 Comm: swapper/0 Not tainted [ 305.919306] Hardware name: Texas Instruments AM654 Base Board (DT) [...] [ 306.017119] x1 : ffff800848031d88 x0 : ffff800848031d80 [ 306.022422] Call trace: [ 306.024866] taprio_free_sched_cb+0x4c/0x98 [ 306.029040] rcu_process_callbacks+0x25c/0x410 [ 306.033476] __do_softirq+0x10c/0x208 [ 306.037132] irq_exit+0xb8/0xc8 [ 306.040267] __handle_domain_irq+0x64/0xb8 [ 306.044352] gic_handle_irq+0x7c/0x178 [ 306.048092] el1_irq+0xb0/0x128 [ 306.051227] arch_cpu_idle+0x10/0x18 [ 306.054795] do_idle+0x120/0x138 [ 306.058015] cpu_startup_entry+0x20/0x28 [ 306.061931] rest_init+0xcc/0xd8 [ 306.065154] start_kernel+0x3bc/0x3e4 [ 306.068810] Code: f2fbd5b7 f2fbd5b6 d503201f f9400422 (f9000662) [ 306.074900] ---[ end trace 96c8e2284a9d9d6e ]--- [ 306.079507] Kernel panic - not syncing: Fatal exception in interrupt [ 306.085847] SMP: stopping secondary CPUs [ 306.089765] Kernel Offset: disabled Try to explain one of the possible crash cases: The "real" admin list is assigned when admin_sched is set to new_admin, it happens after "swap", that assigns to oper_sched NULL. Thus if call qdisc show it can crash. Farther, next second time, when sched list is updated, the admin_sched is not NULL and becomes the oper_sched, previous oper_sched was NULL so just skipped. But then admin_sched is assigned new_admin, but schedules to free previous assigned admin_sched (that already became oper_sched). Farther, next third time, when sched list is updated, while one more swap, oper_sched is not null, but it was happy to be freed already (while prev. admin update), so while try to free oper_sched the kernel panic happens at taprio_free_sched_cb(). So, move the "swap emulation" where it should be according to function comment from code. Fixes: 9c66d15646760e ("taprio: Add support for hardware offloading") Signed-off-by: Ivan Khoronzhuk --- Based on net/master net/sched/sch_taprio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.20.1 Acked-by: Vinicius Costa Gomes Tested-by: Vladimir Oltean diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index 6719a65169d4..286ad4bb50f1 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -1224,8 +1224,6 @@ static int taprio_enable_offload(struct net_device *dev, goto done; } - taprio_offload_config_changed(q); - done: taprio_offload_free(offload); @@ -1505,6 +1503,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, call_rcu(&admin->rcu, taprio_free_sched_cb); spin_unlock_irqrestore(&q->current_entry_lock, flags); + + if (FULL_OFFLOAD_IS_ENABLED(taprio_flags)) + taprio_offload_config_changed(q); } new_admin = NULL;