#include "perf.h" #include "util/debug.h" #include "util/symbol.h" #include "util/sort.h" #include "util/evsel.h" #include "util/evlist.h" #include "util/machine.h" #include "util/thread.h" #include "tests/hists_common.h" static struct { u32 pid; const char *comm; } fake_threads[] = { { FAKE_PID_PERF1, "perf" }, { FAKE_PID_PERF2, "perf" }, { FAKE_PID_BASH, "bash" }, }; static struct { u32 pid; u64 start; const char *filename; } fake_mmap_info[] = { { FAKE_PID_PERF1, FAKE_MAP_PERF, "perf" }, { FAKE_PID_PERF1, FAKE_MAP_LIBC, "libc" }, { FAKE_PID_PERF1, FAKE_MAP_KERNEL, "[kernel]" }, { FAKE_PID_PERF2, FAKE_MAP_PERF, "perf" }, { FAKE_PID_PERF2, FAKE_MAP_LIBC, "libc" }, { FAKE_PID_PERF2, FAKE_MAP_KERNEL, "[kernel]" }, { FAKE_PID_BASH, FAKE_MAP_BASH, "bash" }, { FAKE_PID_BASH, FAKE_MAP_LIBC, "libc" }, { FAKE_PID_BASH, FAKE_MAP_KERNEL, "[kernel]" }, }; struct fake_sym { u64 start; u64 length; const char *name; }; static struct fake_sym perf_syms[] = { { FAKE_SYM_OFFSET1, FAKE_SYM_LENGTH, "main" }, { FAKE_SYM_OFFSET2, FAKE_SYM_LENGTH, "run_command" }, { FAKE_SYM_OFFSET3, FAKE_SYM_LENGTH, "cmd_record" }, }; static struct fake_sym bash_syms[] = { { FAKE_SYM_OFFSET1, FAKE_SYM_LENGTH, "main" }, { FAKE_SYM_OFFSET2, FAKE_SYM_LENGTH, "xmalloc" }, { FAKE_SYM_OFFSET3, FAKE_SYM_LENGTH, "xfree" }, }; static struct fake_sym libc_syms[] = { { 700, 100, "malloc" }, { 800, 100, "free" }, { 900, 100, "realloc" }, { FAKE_SYM_OFFSET1, FAKE_SYM_LENGTH, "malloc" }, { FAKE_SYM_OFFSET2, FAKE_SYM_LENGTH, "free" }, { FAKE_SYM_OFFSET3, FAKE_SYM_LENGTH, "realloc" }, }; static struct fake_sym kernel_syms[] = { { FAKE_SYM_OFFSET1, FAKE_SYM_LENGTH, "schedule" }, { FAKE_SYM_OFFSET2, FAKE_SYM_LENGTH, "page_fault" }, { FAKE_SYM_OFFSET3, FAKE_SYM_LENGTH, "sys_perf_event_open" }, }; static struct { const char *dso_name; struct fake_sym *syms; size_t nr_syms; } fake_symbols[] = { { "perf", perf_syms, ARRAY_SIZE(perf_syms) }, { "bash", bash_syms, ARRAY_SIZE(bash_syms) }, { "libc", libc_syms, ARRAY_SIZE(libc_syms) }, { "[kernel]", kernel_syms, ARRAY_SIZE(kernel_syms) }, }; struct machine *setup_fake_machine(struct machines *machines) { struct machine *machine = machines__find(machines, HOST_KERNEL_ID); size_t i; if (machine == NULL) { pr_debug("Not enough memory for machine setup\n"); return NULL; } for (i = 0; i < ARRAY_SIZE(fake_threads); i++) { struct thread *thread; thread = machine__findnew_thread(machine, fake_threads[i].pid, fake_threads[i].pid); if (thread == NULL) goto out; thread__set_comm(thread, fake_threads[i].comm, 0); thread__put(thread); } for (i = 0; i < ARRAY_SIZE(fake_mmap_info); i++) { struct perf_sample sample = { .cpumode = PERF_RECORD_MISC_USER, }; union perf_event fake_mmap_event = { .mmap = { .pid = fake_mmap_info[i].pid, .tid = fake_mmap_info[i].pid, .start = fake_mmap_info[i].start, .len = FAKE_MAP_LENGTH, .pgoff = 0ULL, }, }; strcpy(fake_mmap_event.mmap.filename, fake_mmap_info[i].filename); machine__process_mmap_event(machine, &fake_mmap_event, &sample); } for (i = 0; i < ARRAY_SIZE(fake_symbols); i++) { size_t k; struct dso *dso; dso = machine__findnew_dso(machine, fake_symbols[i].dso_name); if (dso == NULL) goto out; /* emulate dso__load() */ dso__set_loaded(dso, MAP__FUNCTION); for (k = 0; k < fake_symbols[i].nr_syms; k++) { struct symbol *sym; struct fake_sym *fsym = &fake_symbols[i].syms[k]; sym = symbol__new(fsym->start, fsym->length, STB_GLOBAL, fsym->name); if (sym == NULL) { dso__put(dso); goto out; } symbols__insert(&dso->symbols[MAP__FUNCTION], sym); } dso__put(dso); } return machine; out: pr_debug("Not enough memory for machine setup\n"); machine__delete_threads(machine); return NULL; } void print_hists_in(struct hists *hists) { int i = 0; struct rb_root *root; struct rb_node *node; if (hists__has(hists, need_collapse)) root = &hists->entries_collapsed; else root = hists->entries_in; pr_info("----- %s --------\n", __func__); node = rb_first(root); while (node) { struct hist_entry *he; he = rb_entry(node, struct hist_entry, rb_node_in); if (!he->filtered) { pr_info("%2d: entry: %-8s [%-8s] %20s: period = %"PRIu64"\n", i, thread__comm_str(he->thread), he->ms.map->dso->short_name, he->ms.sym->name, he->stat.period); } i++; node = rb_next(node); } } void print_hists_out(struct hists *hists) { int i = 0; struct rb_root *root; struct rb_node *node; root = &hists->entries; pr_info("----- %s --------\n", __func__); node = rb_first(root); while (node) { struct hist_entry *he; he = rb_entry(node, struct hist_entry, rb_node); if (!he->filtered) { pr_info("%2d: entry: %8s:%5d [%-8s] %20s: period = %"PRIu64"/%"PRIu64"\n", i, thread__comm_str(he->thread), he->thread->tid, he->ms.map->dso->short_name, he->ms.sym->name, he->stat.period, he->stat_acc ? he->stat_acc->period : 0); } i++; node = rb_next(node); } } e/trace/events/sunvnet.h?id=966d2b04e070bc040319aaebfec09e0144dc3341'>966d2b04e070bc040319aaebfec09e0144dc3341 (patch) tree4b96156e3d1dd4dfd6039b7c219c9dc4616da52d /include/trace/events/sunvnet.h parent1b1bc42c1692e9b62756323c675a44cb1a1f9dbd (diff)
percpu-refcount: fix reference leak during percpu-atomic transition
percpu_ref_tryget() and percpu_ref_tryget_live() should return "true" IFF they acquire a reference. But the return value from atomic_long_inc_not_zero() is a long and may have high bits set, e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines is bool so the reference may actually be acquired but the routines return "false" which results in a reference leak since the caller assumes it does not need to do a corresponding percpu_ref_put(). This was seen when performing CPU hotplug during I/O, as hangs in blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start) raced with percpu_ref_tryget (blk_mq_timeout_work). Sample stack trace: __switch_to+0x2c0/0x450 __schedule+0x2f8/0x970 schedule+0x48/0xc0 blk_mq_freeze_queue_wait+0x94/0x120 blk_mq_queue_reinit_work+0xb8/0x180 blk_mq_queue_reinit_prepare+0x84/0xa0 cpuhp_invoke_callback+0x17c/0x600 cpuhp_up_callbacks+0x58/0x150 _cpu_up+0xf0/0x1c0 do_cpu_up+0x120/0x150 cpu_subsys_online+0x64/0xe0 device_online+0xb4/0x120 online_store+0xb4/0xc0 dev_attr_store+0x68/0xa0 sysfs_kf_write+0x80/0xb0 kernfs_fop_write+0x17c/0x250 __vfs_write+0x6c/0x1e0 vfs_write+0xd0/0x270 SyS_write+0x6c/0x110 system_call+0x38/0xe0 Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS, and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests. However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0 and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set. The fix is to make the tryget routines use an actual boolean internally instead of the atomic long result truncated to a int. Fixes: e625305b3907 percpu-refcount: make percpu_ref based on longs instead of ints Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751 Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com> Reviewed-by: Jens Axboe <axboe@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: e625305b3907 ("percpu-refcount: make percpu_ref based on longs instead of ints") Cc: stable@vger.kernel.org # v3.18+
Diffstat (limited to 'include/trace/events/sunvnet.h')