linux-toradex.git/drivers/oprofile, branch v3.0.16

oprofile: Fix uninitialized memory access when writing to writing to oprofilefs

2012-01-06T22:13:51+00:00

commit 913050b91eb94f194392dd797b1ff3779f606ac0 upstream.

If oprofilefs_ulong_from_user() is called with count equals
zero, *val remains unchanged. Depending on the implementation it
might be uninitialized.

Change oprofilefs_ulong_from_user()'s interface to return count
on success. Thus, we are able to return early if count equals
zero which avoids using *val uninitialized. Fixing all users of
oprofilefs_ulong_ from_user().

This follows write syscall implementation when count is zero:
"If count is zero ... [and if] no errors are detected, 0 will be
returned without causing any other effect." (man 2 write)

Reported-By: Mike Waychison 
Signed-off-by: Robert Richter 
Cc: Andrew Morton 
Cc: oprofile-list 
Link: http://lkml.kernel.org/r/20111219153830.GH16765@erda.amd.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman

oprofile: Fix crash when unloading module (hr timer mode)

2011-12-09T16:52:50+00:00

commit 87121ca504fd1d963a66b3fb0c72054b0fd9a177 upstream.

Oprofile may crash in a KVM guest while unlaoding modules. This
happens if oprofile_arch_init() fails and oprofile switches to the hr
timer mode as a fallback. In this case oprofile_arch_exit() is called,
but it never was initialized properly which causes the crash. This
patch fixes this.

oprofile: using timer interrupt.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [] unregister_syscore_ops+0x41/0x58
PGD 41da3f067 PUD 41d80e067 PMD 0
Oops: 0002 [#1] PREEMPT SMP
CPU 5
Modules linked in: oprofile(-)

Pid: 2382, comm: modprobe Not tainted 3.1.0-rc7-00018-g709a39d #18 Advanced Micro Device Anaheim/Anaheim
RIP: 0010:[]  [] unregister_syscore_ops+0x41/0x58
RSP: 0018:ffff88041de1de98  EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffffffffa00060e0 RCX: dead000000200200
RDX: 0000000000000000 RSI: dead000000100100 RDI: ffffffff8178c620
RBP: ffff88041de1dea8 R08: 0000000000000001 R09: 0000000000000082
R10: 0000000000000000 R11: ffff88041de1dde8 R12: 0000000000000080
R13: fffffffffffffff5 R14: 0000000000000001 R15: 0000000000610210
FS:  00007f9ae5bef700(0000) GS:ffff88042fd40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 000000041ca44000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process modprobe (pid: 2382, threadinfo ffff88041de1c000, task ffff88042db6d040)
Stack:
 ffff88041de1deb8 ffffffffa0006770 ffff88041de1deb8 ffffffffa000251e
 ffff88041de1dec8 ffffffffa00022c2 ffff88041de1ded8 ffffffffa0004993
 ffff88041de1df78 ffffffff81073115 656c69666f72706f 0000000000610200
Call Trace:
 [] op_nmi_exit+0x15/0x17 [oprofile]
 [] oprofile_arch_exit+0xe/0x10 [oprofile]
 [] oprofile_exit+0x13/0x15 [oprofile]
 [] sys_delete_module+0x1c3/0x22f
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b
Code: 20 c6 78 81 e8 c5 cc 23 00 48 8b 13 48 8b 43 08 48 be 00 01 10 00 00 00 ad de 48 b9 00 02 20 00 00 00 ad de 48 c7 c7 20 c6 78 81
 89 42 08 48 89 10 48 89 33 48 89 4b 08 e8 a6 c0 23 00 5a 5b
RIP  [] unregister_syscore_ops+0x41/0x58
 RSP 
CR2: 0000000000000008
---[ end trace 06d4e95b6aa3b437 ]---

Signed-off-by: Robert Richter 
Signed-off-by: Greg Kroah-Hartman

oprofile: Fix locking dependency in sync_start()

2011-05-31T14:33:34+00:00

This fixes the A->B/B->A locking dependency, see the warning below.

The function task_exit_notify() is called with (task_exit_notifier)
.rwsem set and then calls sync_buffer() which locks buffer_mutex. In
sync_start() the buffer_mutex was set to prevent notifier functions to
be started before sync_start() is finished. But when registering the
notifier, (task_exit_notifier).rwsem is locked too, but now in
different order than in sync_buffer(). In theory this causes a locking
dependency, what does not occur in practice since task_exit_notify()
is always called after the notifier is registered which means the lock
is already released.

However, after checking the notifier functions it turned out the
buffer_mutex in sync_start() is unnecessary. This is because
sync_buffer() may be called from the notifiers even if sync_start()
did not finish yet, the buffers are already allocated but empty. No
need to protect this with the mutex.

So we fix this theoretical locking dependency by removing buffer_mutex
in sync_start(). This is similar to the implementation before commit:

 750d857 oprofile: fix crash when accessing freed task structs

which introduced the locking dependency.

Lockdep warning:

oprofiled/4447 is trying to acquire lock:
 (buffer_mutex){+.+...}, at: [] sync_buffer+0x31/0x3ec [oprofile]

but task is already holding lock:
 ((task_exit_notifier).rwsem){++++..}, at: [] __blocking_notifier_call_chain+0x39/0x67

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 ((task_exit_notifier).rwsem){++++..}:
       [] lock_acquire+0xf8/0x11e
       [] down_write+0x44/0x67
       [] blocking_notifier_chain_register+0x52/0x8b
       [] profile_event_register+0x2d/0x2f
       [] sync_start+0x47/0xc6 [oprofile]
       [] oprofile_setup+0x60/0xa5 [oprofile]
       [] event_buffer_open+0x59/0x8c [oprofile]
       [] __dentry_open+0x1eb/0x308
       [] nameidata_to_filp+0x60/0x67
       [] do_last+0x5be/0x6b2
       [] path_openat+0xc7/0x360
       [] do_filp_open+0x3d/0x8c
       [] do_sys_open+0x110/0x1a9
       [] sys_open+0x20/0x22
       [] system_call_fastpath+0x16/0x1b

-> #0 (buffer_mutex){+.+...}:
       [] __lock_acquire+0x1085/0x1711
       [] lock_acquire+0xf8/0x11e
       [] mutex_lock_nested+0x63/0x309
       [] sync_buffer+0x31/0x3ec [oprofile]
       [] task_exit_notify+0x16/0x1a [oprofile]
       [] notifier_call_chain+0x37/0x63
       [] __blocking_notifier_call_chain+0x50/0x67
       [] blocking_notifier_call_chain+0x14/0x16
       [] profile_task_exit+0x1a/0x1c
       [] do_exit+0x2a/0x6fc
       [] do_group_exit+0x83/0xae
       [] sys_exit_group+0x17/0x1b
       [] system_call_fastpath+0x16/0x1b

other info that might help us debug this:

1 lock held by oprofiled/4447:
 #0:  ((task_exit_notifier).rwsem){++++..}, at: [] __blocking_notifier_call_chain+0x39/0x67

stack backtrace:
Pid: 4447, comm: oprofiled Not tainted 2.6.39-00007-gcf4d8d4 #10
Call Trace:
 [] print_circular_bug+0xae/0xbc
 [] __lock_acquire+0x1085/0x1711
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] lock_acquire+0xf8/0x11e
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] ? mark_lock+0x42f/0x552
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] mutex_lock_nested+0x63/0x309
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] sync_buffer+0x31/0x3ec [oprofile]
 [] ? __blocking_notifier_call_chain+0x39/0x67
 [] ? __blocking_notifier_call_chain+0x39/0x67
 [] task_exit_notify+0x16/0x1a [oprofile]
 [] notifier_call_chain+0x37/0x63
 [] __blocking_notifier_call_chain+0x50/0x67
 [] blocking_notifier_call_chain+0x14/0x16
 [] profile_task_exit+0x1a/0x1c
 [] do_exit+0x2a/0x6fc
 [] ? retint_swapgs+0xe/0x13
 [] do_group_exit+0x83/0xae
 [] sys_exit_group+0x17/0x1b
 [] system_call_fastpath+0x16/0x1b

Reported-by: Marcin Slusarz 
Cc: Carl Love 
Cc:  # .36+
Signed-off-by: Robert Richter

oprofile: Free potentially owned tasks in case of errors

2011-05-31T14:33:33+00:00

After registering the task free notifier we possibly have tasks in our
dying_tasks list. Free them after unregistering the notifier in case
of an error.

Cc:  # .36+
Signed-off-by: Robert Richter

oprofile: Use linux/mutex.h

2011-05-24T10:45:59+00:00

The oprofile code is still including asm/mutex.h instead of
linux/mutex.h.

Signed-off-by: Anton Blanchard 
Signed-off-by: Robert Richter

oprofile, s390: Rework hwsampler implementation

2011-02-15T10:10:20+00:00

This patch is a rework of the hwsampler oprofile implementation that
has been applied recently. Now there are less non-architectural
changes. The only changes are:

* introduction of oprofile_add_ext_hw_sample(), and
* removal of section attributes of oprofile_timer_init/_exit().

To setup hwsampler for oprofile we need to modify start()/stop()
callbacks and additional hwsampler control files in oprofilefs. We do
not reinitialize the timer or hwsampler mode by restarting calling
init/exit() anymore, instead hwsampler_running is used to switch the
mode directly in oprofile_hwsampler_start/_stop(). For locking reasons
there is also hwsampler_file that reflects the value in oprofilefs.

The overall diffstat of the oprofile s390 hwsampler implemenation
shows the low impact to non-architectural code:

 arch/Kconfig                         |    3 +
 arch/s390/Kconfig                    |    1 +
 arch/s390/oprofile/Makefile          |    2 +-
 arch/s390/oprofile/hwsampler.c       | 1256 ++++++++++++++++++++++++++++++++++
 arch/s390/oprofile/hwsampler.h       |  113 +++
 arch/s390/oprofile/hwsampler_files.c |  162 +++++
 arch/s390/oprofile/init.c            |    6 +-
 drivers/oprofile/cpu_buffer.c        |   24 +-
 drivers/oprofile/timer_int.c         |    4 +-
 include/linux/oprofile.h             |    7 +
 10 files changed, 1567 insertions(+), 11 deletions(-)

Acked-by: Heiko Carstens 
Signed-off-by: Robert Richter

oprofile, s390: Enhance OProfile to support System zs hardware sampling feature

2011-02-15T10:08:50+00:00

OProfile is enhanced to export all files for controlling System z's
hardware sampling, and to invoke hwsampler exported functions to
initialize and use System z's hardware sampling.

The patch invokes hwsampler_setup() during oprofile init and exports
following hwsampler files under oprofilefs if hwsampler's setup
succeeded:

A new directory for hardware sampling based files

 /dev/oprofile/hwsampling/

The userland daemon must explicitly write to the following files
to disable (or enable) hardware based sampling

 /dev/oprofile/hwsampling/hwsampler

to modify the actual sampling rate

 /dev/oprofile/hwsampling/hw_interval

to modify the amount of sampling memory (measured in 4K pages)

 /dev/oprofile/hwsampling/hw_sdbt_blocks

The following files are read only and show
the possible minimum sampling rate

 /dev/oprofile/hwsampling/hw_min_interval

the possible maximum sampling rate

 /dev/oprofile/hwsampling/hw_max_interval

The patch splits the oprofile_timer_[init/exit] function so that it
can be also called through user context (oprofilefs) to avoid kernel
oops.

Applied with following changes:
* whitespace changes in Makefile and timer_int.c

Signed-off-by: Mahesh Salgaonkar 
Signed-off-by: Maran Pakkirisamy 
Signed-off-by: Heinz Graalfs 
Acked-by: Heiko Carstens 
Signed-off-by: Robert Richter

oprofile: Introduce new oprofile sample add function (oprofile_add_ext_hw_sample)

2011-02-15T10:07:07+00:00

This patch introduces a new oprofile sample add function
(oprofile_add_ext_hw_sample) that can also take task_struct as an
argument, which is used by the hwsampler kernel module when copying
hardware samples to OProfile buffers.

Applied with following changes:
* removed #include 
* whitespace changes
* removed conditional compilation (CONFIG_HAVE_HWSAMPLER)
* modified order of functions
* fix missing function definition in header file

Signed-off-by: Mahesh Salgaonkar 
Signed-off-by: Maran Pakkirisamy 
Signed-off-by: Heinz Graalfs 
Acked-by: Heiko Carstens 
Signed-off-by: Robert Richter

Merge branches 'perf-fixes-for-linus' and 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2010-10-30T18:43:26+00:00

* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  jump label: Add work around to i386 gcc asm goto bug
  x86, ftrace: Use safe noops, drop trap test
  jump_label: Fix unaligned traps on sparc.
  jump label: Make arch_jump_label_text_poke_early() optional
  jump label: Fix error with preempt disable holding mutex
  oprofile: Remove deprecated use of flush_scheduled_work()
  oprofile: Fix the hang while taking the cpu offline
  jump label: Fix deadlock b/w jump_label_mutex vs. text_mutex
  jump label: Fix module __init section race

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: Check irq_remapped instead of remapping_enabled in destroy_irq()

Merge branch 'tip/perf/jump-label-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-2.6-trace into perf/urgent

2010-10-30T08:43:08+00:00