forked from mirrors/linux
1f0304dfd9
Marek reported seeing a NULL pointer fault in the xenbus_thread
callstack:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: e030:__wake_up_common+0x4c/0x180
Call Trace:
<TASK>
__wake_up_common_lock+0x82/0xd0
process_msg+0x18e/0x2f0
xenbus_thread+0x165/0x1c0
process_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a
thin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems
like it was xs_wake_up() in this case.
It seems like req may have woken up the xs_wait_for_reply(), which
kfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed
data.
Linux Device Drivers 2nd edition states:
"Normally, a wake_up call can cause an immediate reschedule to happen,
meaning that other processes might run before wake_up returns."
... which would match the behaviour observed.
Change to keeping two krefs on each request. One for the caller, and
one for xenbus_thread. Each will kref_put() when finished, and the last
will free it.
This use of kref matches the description in
Documentation/core-api/kref.rst
Link: https://lore.kernel.org/xen-devel/ZO0WrR5J0xuwDIxW@mail-itl/
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| events | ||
| xen-pciback | ||
| xenbus | ||
| xenfs | ||
| acpi.c | ||
| arm-device.c | ||
| balloon.c | ||
| biomerge.c | ||
| cpu_hotplug.c | ||
| dbgp.c | ||
| efi.c | ||
| evtchn.c | ||
| features.c | ||
| gntalloc.c | ||
| gntdev-common.h | ||
| gntdev-dmabuf.c | ||
| gntdev-dmabuf.h | ||
| gntdev.c | ||
| grant-dma-iommu.c | ||
| grant-dma-ops.c | ||
| grant-table.c | ||
| Kconfig | ||
| Makefile | ||
| manage.c | ||
| mcelog.c | ||
| mem-reservation.c | ||
| pci.c | ||
| pcpu.c | ||
| platform-pci.c | ||
| privcmd-buf.c | ||
| privcmd.c | ||
| privcmd.h | ||
| pvcalls-back.c | ||
| pvcalls-front.c | ||
| pvcalls-front.h | ||
| swiotlb-xen.c | ||
| sys-hypervisor.c | ||
| time.c | ||
| unpopulated-alloc.c | ||
| xen-acpi-pad.c | ||
| xen-acpi-processor.c | ||
| xen-balloon.c | ||
| xen-front-pgdir-shbuf.c | ||
| xen-scsiback.c | ||
| xlate_mmu.c | ||