Commit c05a5ac0 authored by Junhao He's avatar Junhao He Committed by JiangShui
Browse files

coresight: ultrasoc-smb: Fix sleep while close preempt in enable_smb 

maillist inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8ICOU
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux.git/commit/?h=fixes&id=b8411287aef4a994eff0c68f5597910c4194dfe3



---------------------------------------------------------------------------

When we to enable the SMB by perf, the perf sched will call perf_ctx_lock()
to close system preempt in event_function_call(). But SMB::enable_smb() use
mutex to lock the critical section, which may sleep.

 BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 153023, name: perf
 preempt_count: 2, expected: 0
 RCU nest depth: 0, expected: 0
 INFO: lockdep is turned off.
 irq event stamp: 0
 hardirqs last  enabled at (0): [<0000000000000000>] 0x0
 hardirqs last disabled at (0): [<ffffa2983f5c5f40>] copy_process+0xae8/0x2b48
 softirqs last  enabled at (0): [<ffffa2983f5c5f40>] copy_process+0xae8/0x2b48
 softirqs last disabled at (0): [<0000000000000000>] 0x0
 CPU: 2 PID: 153023 Comm: perf Kdump: loaded Tainted: G   W  O   6.5.0-rc4+ #1

 Call trace:
 ...
  __mutex_lock+0xbc/0xa70
  mutex_lock_nested+0x34/0x48
  smb_update_buffer+0x58/0x360 [ultrasoc_smb]
  etm_event_stop+0x204/0x2d8 [coresight]
  etm_event_del+0x1c/0x30 [coresight]
  event_sched_out+0x17c/0x3b8
  group_sched_out.part.0+0x5c/0x208
  __perf_event_disable+0x15c/0x210
  event_function+0xe0/0x230
  remote_function+0xb4/0xe8
  generic_exec_single+0x160/0x268
  smp_call_function_single+0x20c/0x2a0
  event_function_call+0x20c/0x220
  _perf_event_disable+0x5c/0x90
  perf_event_for_each_child+0x58/0xc0
  _perf_ioctl+0x34c/0x1250
  perf_ioctl+0x64/0x98
 ...

Use spinlock to replace mutex to control driver data access to one at a
time. The function copy_to_user() may sleep, it cannot be in a spinlock
context, so we can't simply replace it in smb_read(). But we can ensure
that only one user gets the SMB device fd by smb_open(), so remove the
locks from smb_read() and buffer synchronization is guaranteed by the user.

Fixes: 06f5c292 ("drivers/coresight: Add UltraSoc System Memory Buffer driver")
Signed-off-by: default avatarJunhao He <hejunhao3@huawei.com>
Reviewed-by: default avatarJames Clark <james.clark@arm.com>
Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: default avatarCai Jian <caijian11@h-partners.com>
Link: https://lore.kernel.org/r/20231114133346.30489-2-hejunhao3@huawei.com
parent 118901df

drivers/hwtracing/coresight/ultrasoc-smb.c

+14 −21
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ static int smb_open(struct inode *inode, struct file *file) 
					struct smb_drv_data, miscdev);

	int ret = 0;



	mutex_lock(&drvdata->mutex);

	spin_lock(&drvdata->spinlock);



	if (drvdata->reading) {

		ret = -EBUSY;
@@ -115,7 +115,7 @@ static int smb_open(struct inode *inode, struct file *file) 


	drvdata->reading = true;

out:

	mutex_unlock(&drvdata->mutex);

	spin_unlock(&drvdata->spinlock);



	return ret;

}
@@ -132,10 +132,8 @@ static ssize_t smb_read(struct file *file, char __user *data, size_t len, 
	if (!len)

		return 0;



	mutex_lock(&drvdata->mutex);



	if (!sdb->data_size)

		goto out;

		return 0;



	to_copy = min(sdb->data_size, len);
@@ -145,20 +143,15 @@ static ssize_t smb_read(struct file *file, char __user *data, size_t len, 


	if (copy_to_user(data, sdb->buf_base + sdb->buf_rdptr, to_copy)) {

		dev_dbg(dev, "Failed to copy data to user\n");

		to_copy = -EFAULT;

		goto out;

		return -EFAULT;

	}



	*ppos += to_copy;



	smb_update_read_ptr(drvdata, to_copy);



	dev_dbg(dev, "%zu bytes copied\n", to_copy);

out:

	if (!sdb->data_size)

		smb_reset_buffer(drvdata);

	mutex_unlock(&drvdata->mutex);



	dev_dbg(dev, "%zu bytes copied\n", to_copy);

	return to_copy;

}
@@ -167,9 +160,9 @@ static int smb_release(struct inode *inode, struct file *file) 
	struct smb_drv_data *drvdata = container_of(file->private_data,

					struct smb_drv_data, miscdev);



	mutex_lock(&drvdata->mutex);

	spin_lock(&drvdata->spinlock);

	drvdata->reading = false;

	mutex_unlock(&drvdata->mutex);

	spin_unlock(&drvdata->spinlock);



	return 0;

}
@@ -261,7 +254,7 @@ static int smb_enable(struct coresight_device *csdev, u32 mode, void *data) 
	struct smb_drv_data *drvdata = dev_get_drvdata(csdev->dev.parent);

	int ret = 0;



	mutex_lock(&drvdata->mutex);

	spin_lock(&drvdata->spinlock);



	/* Do nothing, the trace data is reading by other interface now */

	if (drvdata->reading) {
@@ -293,7 +286,7 @@ static int smb_enable(struct coresight_device *csdev, u32 mode, void *data) 


	dev_dbg(&csdev->dev, "Ultrasoc SMB enabled\n");

out:

	mutex_unlock(&drvdata->mutex);

	spin_unlock(&drvdata->spinlock);



	return ret;

}
@@ -303,7 +296,7 @@ static int smb_disable(struct coresight_device *csdev) 
	struct smb_drv_data *drvdata = dev_get_drvdata(csdev->dev.parent);

	int ret = 0;



	mutex_lock(&drvdata->mutex);

	spin_lock(&drvdata->spinlock);



	if (drvdata->reading) {

		ret = -EBUSY;
@@ -326,7 +319,7 @@ static int smb_disable(struct coresight_device *csdev) 


	dev_dbg(&csdev->dev, "Ultrasoc SMB disabled\n");

out:

	mutex_unlock(&drvdata->mutex);

	spin_unlock(&drvdata->spinlock);



	return ret;

}
@@ -407,7 +400,7 @@ static unsigned long smb_update_buffer(struct coresight_device *csdev, 
	if (!buf)

		return 0;



	mutex_lock(&drvdata->mutex);

	spin_lock(&drvdata->spinlock);



	/* Don't do anything if another tracer is using this sink. */

	if (atomic_read(csdev->refcnt) != 1)
@@ -431,7 +424,7 @@ static unsigned long smb_update_buffer(struct coresight_device *csdev, 
	if (!buf->snapshot && lost)

		perf_aux_output_flag(handle, PERF_AUX_FLAG_TRUNCATED);

out:

	mutex_unlock(&drvdata->mutex);

	spin_unlock(&drvdata->spinlock);



	return data_size;

}
@@ -589,7 +582,7 @@ static int smb_probe(struct platform_device *pdev) 
		return ret;

	}



	mutex_init(&drvdata->mutex);

	spin_lock_init(&drvdata->spinlock);

	drvdata->pid = -1;



	ret = smb_register_sink(pdev, drvdata);

drivers/hwtracing/coresight/ultrasoc-smb.h

+3 −3
Original line number Diff line number Diff line
@@ -8,7 +8,7 @@ 
#define _ULTRASOC_SMB_H



#include <linux/miscdevice.h>

#include <linux/mutex.h>

#include <linux/spinlock.h>



/* Offset of SMB global registers */

#define SMB_GLB_CFG_REG		0x00
@@ -105,7 +105,7 @@ struct smb_data_buffer { 
 * @csdev:	Component vitals needed by the framework.

 * @sdb:	Data buffer for SMB.

 * @miscdev:	Specifics to handle "/dev/xyz.smb" entry.

 * @mutex:	Control data access to one at a time.

 * @spinlock:	Control data access to one at a time.

 * @reading:	Synchronise user space access to SMB buffer.

 * @pid:	Process ID of the process being monitored by the

 *		session that is using this component.
@@ -116,7 +116,7 @@ struct smb_drv_data { 
	struct coresight_device	*csdev;

	struct smb_data_buffer sdb;

	struct miscdevice miscdev;

	struct mutex mutex;

	spinlock_t spinlock;

	bool reading;

	pid_t pid;

	u32 mode;