Skip to content

Commit ce5c31d

Browse files
Julien Gralltorvalds
Julien Grall
authored and
torvalds
committed
lib/ubsan: don't serialize UBSAN report
At the moment, UBSAN report will be serialized using a spin_lock(). On RT-systems, spinlocks are turned to rt_spin_lock and may sleep. This will result to the following splat if the undefined behavior is in a context that can sleep: BUG: sleeping function called from invalid context at /src/linux/kernel/locking/rtmutex.c:968 in_atomic(): 1, irqs_disabled(): 128, pid: 3447, name: make 1 lock held by make/3447: #0: 000000009a966332 (&mm->mmap_sem){++++}, at: do_page_fault+0x140/0x4f8 irq event stamp: 6284 hardirqs last enabled at (6283): [<ffff000011326520>] _raw_spin_unlock_irqrestore+0x90/0xa0 hardirqs last disabled at (6284): [<ffff0000113262b0>] _raw_spin_lock_irqsave+0x30/0x78 softirqs last enabled at (2430): [<ffff000010088ef8>] fpsimd_restore_current_state+0x60/0xe8 softirqs last disabled at (2427): [<ffff000010088ec0>] fpsimd_restore_current_state+0x28/0xe8 Preemption disabled at: [<ffff000011324a4c>] rt_mutex_futex_unlock+0x4c/0xb0 CPU: 3 PID: 3447 Comm: make Tainted: G W 5.2.14-rt7-01890-ge6e057589653 #911 Call trace: dump_backtrace+0x0/0x148 show_stack+0x14/0x20 dump_stack+0xbc/0x104 ___might_sleep+0x154/0x210 rt_spin_lock+0x68/0xa0 ubsan_prologue+0x30/0x68 handle_overflow+0x64/0xe0 __ubsan_handle_add_overflow+0x10/0x18 __lock_acquire+0x1c28/0x2a28 lock_acquire+0xf0/0x370 _raw_spin_lock_irqsave+0x58/0x78 rt_mutex_futex_unlock+0x4c/0xb0 rt_spin_unlock+0x28/0x70 get_page_from_freelist+0x428/0x2b60 __alloc_pages_nodemask+0x174/0x1708 alloc_pages_vma+0x1ac/0x238 __handle_mm_fault+0x4ac/0x10b0 handle_mm_fault+0x1d8/0x3b0 do_page_fault+0x1c8/0x4f8 do_translation_fault+0xb8/0xe0 do_mem_abort+0x3c/0x98 el0_da+0x20/0x24 The spin_lock() will protect against multiple CPUs to output a report together, I guess to prevent them from being interleaved. However, they can still interleave with other messages (and even splat from __might_sleep). So the lock usefulness seems pretty limited. Rather than trying to accomodate RT-system by switching to a raw_spin_lock(), the lock is now completely dropped. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Julien Grall <[email protected]> Reported-by: Andre Przywara <[email protected]> Acked-by: Andrey Ryabinin <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Sebastian Andrzej Siewior <[email protected]> Cc: Steven Rostedt <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
1 parent 8f6a7f9 commit ce5c31d

File tree

1 file changed

+23
-41
lines changed

1 file changed

+23
-41
lines changed

‎lib/ubsan.c

Lines changed: 23 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -140,25 +140,21 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type,
140140
}
141141
}
142142

143-
static DEFINE_SPINLOCK(report_lock);
144-
145-
static void ubsan_prologue(struct source_location *location,
146-
unsigned long *flags)
143+
static void ubsan_prologue(struct source_location *location)
147144
{
148145
current->in_ubsan++;
149-
spin_lock_irqsave(&report_lock, *flags);
150146

151147
pr_err("========================================"
152148
"========================================\n");
153149
print_source_location("UBSAN: Undefined behaviour in", location);
154150
}
155151

156-
static void ubsan_epilogue(unsigned long *flags)
152+
static void ubsan_epilogue(void)
157153
{
158154
dump_stack();
159155
pr_err("========================================"
160156
"========================================\n");
161-
spin_unlock_irqrestore(&report_lock, *flags);
157+
162158
current->in_ubsan--;
163159
}
164160

@@ -167,14 +163,13 @@ static void handle_overflow(struct overflow_data *data, void *lhs,
167163
{
168164

169165
struct type_descriptor *type = data->type;
170-
unsigned long flags;
171166
char lhs_val_str[VALUE_LENGTH];
172167
char rhs_val_str[VALUE_LENGTH];
173168

174169
if (suppress_report(&data->location))
175170
return;
176171

177-
ubsan_prologue(&data->location, &flags);
172+
ubsan_prologue(&data->location);
178173

179174
val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs);
180175
val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs);
@@ -186,7 +181,7 @@ static void handle_overflow(struct overflow_data *data, void *lhs,
186181
rhs_val_str,
187182
type->type_name);
188183

189-
ubsan_epilogue(&flags);
184+
ubsan_epilogue();
190185
}
191186

192187
void __ubsan_handle_add_overflow(struct overflow_data *data,
@@ -214,34 +209,32 @@ EXPORT_SYMBOL(__ubsan_handle_mul_overflow);
214209
void __ubsan_handle_negate_overflow(struct overflow_data *data,
215210
void *old_val)
216211
{
217-
unsigned long flags;
218212
char old_val_str[VALUE_LENGTH];
219213

220214
if (suppress_report(&data->location))
221215
return;
222216

223-
ubsan_prologue(&data->location, &flags);
217+
ubsan_prologue(&data->location);
224218

225219
val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val);
226220

227221
pr_err("negation of %s cannot be represented in type %s:\n",
228222
old_val_str, data->type->type_name);
229223

230-
ubsan_epilogue(&flags);
224+
ubsan_epilogue();
231225
}
232226
EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
233227

234228

235229
void __ubsan_handle_divrem_overflow(struct overflow_data *data,
236230
void *lhs, void *rhs)
237231
{
238-
unsigned long flags;
239232
char rhs_val_str[VALUE_LENGTH];
240233

241234
if (suppress_report(&data->location))
242235
return;
243236

244-
ubsan_prologue(&data->location, &flags);
237+
ubsan_prologue(&data->location);
245238

246239
val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
247240

@@ -251,58 +244,52 @@ void __ubsan_handle_divrem_overflow(struct overflow_data *data,
251244
else
252245
pr_err("division by zero\n");
253246

254-
ubsan_epilogue(&flags);
247+
ubsan_epilogue();
255248
}
256249
EXPORT_SYMBOL(__ubsan_handle_divrem_overflow);
257250

258251
static void handle_null_ptr_deref(struct type_mismatch_data_common *data)
259252
{
260-
unsigned long flags;
261-
262253
if (suppress_report(data->location))
263254
return;
264255

265-
ubsan_prologue(data->location, &flags);
256+
ubsan_prologue(data->location);
266257

267258
pr_err("%s null pointer of type %s\n",
268259
type_check_kinds[data->type_check_kind],
269260
data->type->type_name);
270261

271-
ubsan_epilogue(&flags);
262+
ubsan_epilogue();
272263
}
273264

274265
static void handle_misaligned_access(struct type_mismatch_data_common *data,
275266
unsigned long ptr)
276267
{
277-
unsigned long flags;
278-
279268
if (suppress_report(data->location))
280269
return;
281270

282-
ubsan_prologue(data->location, &flags);
271+
ubsan_prologue(data->location);
283272

284273
pr_err("%s misaligned address %p for type %s\n",
285274
type_check_kinds[data->type_check_kind],
286275
(void *)ptr, data->type->type_name);
287276
pr_err("which requires %ld byte alignment\n", data->alignment);
288277

289-
ubsan_epilogue(&flags);
278+
ubsan_epilogue();
290279
}
291280

292281
static void handle_object_size_mismatch(struct type_mismatch_data_common *data,
293282
unsigned long ptr)
294283
{
295-
unsigned long flags;
296-
297284
if (suppress_report(data->location))
298285
return;
299286

300-
ubsan_prologue(data->location, &flags);
287+
ubsan_prologue(data->location);
301288
pr_err("%s address %p with insufficient space\n",
302289
type_check_kinds[data->type_check_kind],
303290
(void *) ptr);
304291
pr_err("for an object of type %s\n", data->type->type_name);
305-
ubsan_epilogue(&flags);
292+
ubsan_epilogue();
306293
}
307294

308295
static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data,
@@ -351,25 +338,23 @@ EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1);
351338

352339
void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index)
353340
{
354-
unsigned long flags;
355341
char index_str[VALUE_LENGTH];
356342

357343
if (suppress_report(&data->location))
358344
return;
359345

360-
ubsan_prologue(&data->location, &flags);
346+
ubsan_prologue(&data->location);
361347

362348
val_to_string(index_str, sizeof(index_str), data->index_type, index);
363349
pr_err("index %s is out of range for type %s\n", index_str,
364350
data->array_type->type_name);
365-
ubsan_epilogue(&flags);
351+
ubsan_epilogue();
366352
}
367353
EXPORT_SYMBOL(__ubsan_handle_out_of_bounds);
368354

369355
void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
370356
void *lhs, void *rhs)
371357
{
372-
unsigned long flags;
373358
struct type_descriptor *rhs_type = data->rhs_type;
374359
struct type_descriptor *lhs_type = data->lhs_type;
375360
char rhs_str[VALUE_LENGTH];
@@ -379,7 +364,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
379364
if (suppress_report(&data->location))
380365
goto out;
381366

382-
ubsan_prologue(&data->location, &flags);
367+
ubsan_prologue(&data->location);
383368

384369
val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);
385370
val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
@@ -402,7 +387,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
402387
lhs_str, rhs_str,
403388
lhs_type->type_name);
404389

405-
ubsan_epilogue(&flags);
390+
ubsan_epilogue();
406391
out:
407392
user_access_restore(ua_flags);
408393
}
@@ -411,31 +396,28 @@ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
411396

412397
void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
413398
{
414-
unsigned long flags;
415-
416-
ubsan_prologue(&data->location, &flags);
399+
ubsan_prologue(&data->location);
417400
pr_err("calling __builtin_unreachable()\n");
418-
ubsan_epilogue(&flags);
401+
ubsan_epilogue();
419402
panic("can't return from __builtin_unreachable()");
420403
}
421404
EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable);
422405

423406
void __ubsan_handle_load_invalid_value(struct invalid_value_data *data,
424407
void *val)
425408
{
426-
unsigned long flags;
427409
char val_str[VALUE_LENGTH];
428410

429411
if (suppress_report(&data->location))
430412
return;
431413

432-
ubsan_prologue(&data->location, &flags);
414+
ubsan_prologue(&data->location);
433415

434416
val_to_string(val_str, sizeof(val_str), data->type, val);
435417

436418
pr_err("load of value %s is not a valid value for type %s\n",
437419
val_str, data->type->type_name);
438420

439-
ubsan_epilogue(&flags);
421+
ubsan_epilogue();
440422
}
441423
EXPORT_SYMBOL(__ubsan_handle_load_invalid_value);

0 commit comments

Comments
 (0)