/*
 * RT-Mutexes: blocking mutual exclusion locks with PI support
 *
 * started by Ingo Molnar and Thomas Gleixner:
 *
 *  Copyright (C) 2004-2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
 *  Copyright (C) 2006 Timesys Corp., Thomas Gleixner <tglx@timesys.com>
 *
 * This code is based on the rt.c implementation in the preempt-rt tree.
 * Portions of said code are
 *
 *  Copyright (C) 2004  LynuxWorks, Inc., Igor Manyilov, Bill Huey
 *  Copyright (C) 2006  Esben Nielsen
 *  Copyright (C) 2006  Kihon Technologies Inc.,
 *			Steven Rostedt <rostedt@goodmis.org>
 *
 * See rt.c in preempt-rt for proper credits and further information
 */
#include <linux/sched.h>
#include <linux/sched/rt.h>
#include <linux/delay.h>
#include <linux/export.h>
#include <linux/spinlock.h>
#include <linux/kallsyms.h>
#include <linux/syscalls.h>
#include <linux/interrupt.h>
#include <linux/rbtree.h>
#include <linux/fs.h>
#include <linux/debug_locks.h>

#include "rtmutex_common.h"

static void printk_task(struct task_struct *p)
{
	if (p)
		printk("%16s:%5d [%p, %3d]", p->comm, task_pid_nr(p), p, p->prio);
	else
		printk("<none>");
}

static void printk_lock(struct rt_mutex *lock, int print_owner)
{
	if (lock->name)
		printk(" [%p] {%s}\n",
			lock, lock->name);
	else
		printk(" [%p] {%s:%d}\n",
			lock, lock->file, lock->line);

	if (print_owner && rt_mutex_owner(lock)) {
		printk(".. ->owner: %p\n", lock->owner);
		printk(".. held by:  ");
		printk_task(rt_mutex_owner(lock));
		printk("\n");
	}
}

void rt_mutex_debug_task_free(struct task_struct *task)
{
	DEBUG_LOCKS_WARN_ON(!RB_EMPTY_ROOT(&task->pi_waiters));
	DEBUG_LOCKS_WARN_ON(task->pi_blocked_on);
}

/*
 * We fill out the fields in the waiter to store the information about
 * the deadlock. We print when we return. act_waiter can be NULL in
 * case of a remove waiter operation.
 */
void debug_rt_mutex_deadlock(enum rtmutex_chainwalk chwalk,
			     struct rt_mutex_waiter *act_waiter,
			     struct rt_mutex *lock)
{
	struct task_struct *task;

	if (!debug_locks || chwalk == RT_MUTEX_FULL_CHAINWALK || !act_waiter)
		return;

	task = rt_mutex_owner(act_waiter->lock);
	if (task && task != current) {
		act_waiter->deadlock_task_pid = get_pid(task_pid(task));
		act_waiter->deadlock_lock = lock;
	}
}

void debug_rt_mutex_print_deadlock(struct rt_mutex_waiter *waiter)
{
	struct task_struct *task;

	if (!waiter->deadlock_lock || !debug_locks)
		return;

	rcu_read_lock();
	task = pid_task(waiter->deadlock_task_pid, PIDTYPE_PID);
	if (!task) {
		rcu_read_unlock();
		return;
	}

	if (!debug_locks_off()) {
		rcu_read_unlock();
		return;
	}

	printk("\n============================================\n");
	printk(  "[ BUG: circular locking deadlock detected! ]\n");
	printk("%s\n", print_tainted());
	printk(  "--------------------------------------------\n");
	printk("%s/%d is deadlocking current task %s/%d\n\n",
	       task->comm, task_pid_nr(task),
	       current->comm, task_pid_nr(current));

	printk("\n1) %s/%d is trying to acquire this lock:\n",
	       current->comm, task_pid_nr(current));
	printk_lock(waiter->lock, 1);

	printk("\n2) %s/%d is blocked on this lock:\n",
		task->comm, task_pid_nr(task));
	printk_lock(waiter->deadlock_lock, 1);

	debug_show_held_locks(current);
	debug_show_held_locks(task);

	printk("\n%s/%d's [blocked] stackdump:\n\n",
		task->comm, task_pid_nr(task));
	show_stack(task, NULL);
	printk("\n%s/%d's [current] stackdump:\n\n",
		current->comm, task_pid_nr(current));
	dump_stack();
	debug_show_all_locks();
	rcu_read_unlock();

	printk("[ turning off deadlock detection."
	       "Please report this trace. ]\n\n");
}

void debug_rt_mutex_lock(struct rt_mutex *lock)
{
}

void debug_rt_mutex_unlock(struct rt_mutex *lock)
{
	DEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current);
}

void
debug_rt_mutex_proxy_lock(struct rt_mutex *lock, struct task_struct *powner)
{
}

void debug_rt_mutex_proxy_unlock(struct rt_mutex *lock)
{
	DEBUG_LOCKS_WARN_ON(!rt_mutex_owner(lock));
}

void debug_rt_mutex_init_waiter(struct rt_mutex_waiter *waiter)
{
	memset(waiter, 0x11, sizeof(*waiter));
	waiter->deadlock_task_pid = NULL;
}

void debug_rt_mutex_free_waiter(struct rt_mutex_waiter *waiter)
{
	put_pid(waiter->deadlock_task_pid);
	memset(waiter, 0x22, sizeof(*waiter));
}

void debug_rt_mutex_init(struct rt_mutex *lock, const char *name)
{
	/*
	 * Make sure we are not reinitializing a held lock:
	 */
	debug_check_no_locks_freed((void *)lock, sizeof(*lock));
	lock->name = name;
}

void
rt_mutex_deadlock_account_lock(struct rt_mutex *lock, struct task_struct *task)
{
}

void rt_mutex_deadlock_account_unlock(struct task_struct *task)
{
}

h>committer</th><td>David S. Miller &lt;davem@davemloft.net&gt;</td><td class='right'>2017-02-02 21:27:05 -0500</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers?h=nds-private-remove&amp;id=f32b20e89e82c9ff1825fc5c5d69753ff5558ccd'>f32b20e89e82c9ff1825fc5c5d69753ff5558ccd</a> (<a href='/cgit.cgi/linux/net-next.git/patch/drivers?id=f32b20e89e82c9ff1825fc5c5d69753ff5558ccd'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?h=nds-private-remove&amp;id=f32b20e89e82c9ff1825fc5c5d69753ff5558ccd'>1ef83d73e9faa8e975150121b1937b0eec57804a</a> /<a href='/cgit.cgi/linux/net-next.git/tree/drivers?h=nds-private-remove&amp;id=f32b20e89e82c9ff1825fc5c5d69753ff5558ccd'>drivers</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers?h=nds-private-remove&amp;id=6d04dfc8966019b8b0977b2cb942351f13d2b178'>6d04dfc8966019b8b0977b2cb942351f13d2b178</a> (<a href='/cgit.cgi/linux/net-next.git/diff/drivers?h=nds-private-remove&amp;id=f32b20e89e82c9ff1825fc5c5d69753ff5558ccd&amp;id2=6d04dfc8966019b8b0977b2cb942351f13d2b178'>diff</a>)</td></tr></table>
<div class='commit-subject'>mlx4: Fix memory leak after mlx4_en_update_priv()</div><div class='commit-msg'>In mlx4_en_update_priv(), dst-&gt;tx_ring[t] and dst-&gt;tx_cq[t]
are over-written by src-&gt;tx_ring[t] and src-&gt;tx_cq[t] without
first calling kfree.

One of the reproducible code paths is by doing 'ethtool -L'.

The fix is to do the kfree in mlx4_en_free_resources().

Here is the kmemleak report:
unreferenced object 0xffff880841211800 (size 2048):
  comm "ethtool", pid 3096, jiffies 4294716940 (age 528.353s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff81930718&gt;] kmemleak_alloc+0x28/0x50
    [&lt;ffffffff8120b213&gt;] kmem_cache_alloc_trace+0x103/0x260
    [&lt;ffffffff8170e0a8&gt;] mlx4_en_try_alloc_resources+0x118/0x1a0
    [&lt;ffffffff817065a9&gt;] mlx4_en_set_ringparam+0x169/0x210
    [&lt;ffffffff818040c5&gt;] dev_ethtool+0xae5/0x2190
    [&lt;ffffffff8181b898&gt;] dev_ioctl+0x168/0x6f0
    [&lt;ffffffff817d7a72&gt;] sock_do_ioctl+0x42/0x50
    [&lt;ffffffff817d819b&gt;] sock_ioctl+0x21b/0x2d0
    [&lt;ffffffff81247a73&gt;] do_vfs_ioctl+0x93/0x6a0
    [&lt;ffffffff812480f9&gt;] SyS_ioctl+0x79/0x90
    [&lt;ffffffff8193d7ea&gt;] entry_SYSCALL_64_fastpath+0x18/0xad
    [&lt;ffffffffffffffff&gt;] 0xffffffffffffffff
unreferenced object 0xffff880841213000 (size 2048):
  comm "ethtool", pid 3096, jiffies 4294716940 (age 528.353s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;ffffffff81930718&gt;] kmemleak_alloc+0x28/0x50
    [&lt;ffffffff8120b213&gt;] kmem_cache_alloc_trace+0x103/0x260
    [&lt;ffffffff8170e0cb&gt;] mlx4_en_try_alloc_resources+0x13b/0x1a0
    [&lt;ffffffff817065a9&gt;] mlx4_en_set_ringparam+0x169/0x210
    [&lt;ffffffff818040c5&gt;] dev_ethtool+0xae5/0x2190
    [&lt;ffffffff8181b898&gt;] dev_ioctl+0x168/0x6f0
    [&lt;ffffffff817d7a72&gt;] sock_do_ioctl+0x42/0x50
    [&lt;ffffffff817d819b&gt;] sock_ioctl+0x21b/0x2d0
    [&lt;ffffffff81247a73&gt;] do_vfs_ioctl+0x93/0x6a0
    [&lt;ffffffff812480f9&gt;] SyS_ioctl+0x79/0x90
    [&lt;ffffffff8193d7ea&gt;] entry_SYSCALL_64_fastpath+0x18/0xad
    [&lt;ffffffffffffffff&gt;] 0xffffffffffffffff

(gdb) list *mlx4_en_try_alloc_resources+0x118
0xffffffff8170e0a8 is in mlx4_en_try_alloc_resources (drivers/net/ethernet/mellanox/mlx4/en_netdev.c:2145).
2140                    if (!dst-&gt;tx_ring_num[t])
2141                            continue;
2142
2143                    dst-&gt;tx_ring[t] = kzalloc(sizeof(struct mlx4_en_tx_ring *) *
2144                                              MAX_TX_RINGS, GFP_KERNEL);
2145                    if (!dst-&gt;tx_ring[t])
2146                            goto err_free_tx;
2147
2148                    dst-&gt;tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) *
2149                                            MAX_TX_RINGS, GFP_KERNEL);
(gdb) list *mlx4_en_try_alloc_resources+0x13b
0xffffffff8170e0cb is in mlx4_en_try_alloc_resources (drivers/net/ethernet/mellanox/mlx4/en_netdev.c:2150).
2145                    if (!dst-&gt;tx_ring[t])
2146                            goto err_free_tx;
2147
2148                    dst-&gt;tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) *
2149                                            MAX_TX_RINGS, GFP_KERNEL);
2150                    if (!dst-&gt;tx_cq[t]) {
2151                            kfree(dst-&gt;tx_ring[t]);
2152                            goto err_free_tx;
2153                    }
2154            }

Fixes: ec25bc04ed8e ("net/mlx4_en: Add resilience in low memory systems")
Cc: Eugenia Emantayev &lt;eugenia@mellanox.com&gt;
Cc: Saeed Mahameed &lt;saeedm@mellanox.com&gt;
Cc: Tariq Toukan &lt;tariqt@mellanox.com&gt;
Signed-off-by: Martin KaFai Lau &lt;kafai@fb.com&gt;
Reviewed-by: Tariq Toukan &lt;tariqt@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?h=nds-private-remove&amp;id=f32b20e89e82c9ff1825fc5c5d69753ff5558ccd'>Diffstat</a> (limited to 'drivers')</div><table summary='diffstat' class='diffstat'>