WARNING in tracepoint_probe_register_prio

29 views
Skip to first unread message

syzbot

unread,
Oct 27, 2017, 4:09:54 AM10/27/17
to linux-...@vger.kernel.org, mi...@kernel.org, ros...@goodmis.org, syzkall...@googlegroups.com
Hello,

syzkaller hit the following crash on
3e0cc09a3a2c40ec1ffb6b4e12da86e98feccb11
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.




RDX: 00000000ffffffff RSI: 00000000ffffffff RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
------------[ cut here ]------------
WARNING: CPU: 0 PID: 16974 at kernel/tracepoint.c:210 tracepoint_add_func
kernel/tracepoint.c:210 [inline]
WARNING: CPU: 0 PID: 16974 at kernel/tracepoint.c:210
tracepoint_probe_register_prio+0x397/0x9a0 kernel/tracepoint.c:283
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 16974 Comm: syz-executor3 Not tainted 4.14.0-rc5+ #47
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
panic+0x1e4/0x417 kernel/panic.c:181
__warn+0x1c4/0x1d9 kernel/panic.c:542
report_bug+0x211/0x2d0 lib/bug.c:183
fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:178
do_trap_no_signal arch/x86/kernel/traps.c:212 [inline]
do_trap+0x260/0x390 arch/x86/kernel/traps.c:261
do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:298
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:311
invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905
RIP: 0010:tracepoint_add_func kernel/tracepoint.c:210 [inline]
RIP: 0010:tracepoint_probe_register_prio+0x397/0x9a0 kernel/tracepoint.c:283
RSP: 0018:ffff8801cd2c7418 EFLAGS: 00010246
RAX: 0000000000010000 RBX: 00000000fffffff4 RCX: ffffc90003466000
RDX: 0000000000010000 RSI: ffffffff81700a27 RDI: 0000000000000282
RBP: ffff8801cd2c7520 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8801cd2c74f8
tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304
trace_event_reg+0x167/0x320 kernel/trace/trace_events.c:305
perf_trace_event_reg kernel/trace/trace_event_perf.c:122 [inline]
perf_trace_event_init kernel/trace/trace_event_perf.c:197 [inline]
perf_trace_init+0x4ef/0xab0 kernel/trace/trace_event_perf.c:221
perf_tp_event_init+0x7d/0xf0 kernel/events/core.c:8037
perf_try_init_event+0xc9/0x1f0 kernel/events/core.c:9270
perf_init_event kernel/events/core.c:9308 [inline]
perf_event_alloc+0x1c5b/0x2a00 kernel/events/core.c:9567
SYSC_perf_event_open+0x84e/0x2e00 kernel/events/core.c:10022
SyS_perf_event_open+0x39/0x50 kernel/events/core.c:9908
do_syscall_32_irqs_on arch/x86/entry/common.c:329 [inline]
do_fast_syscall_32+0x3f2/0xf05 arch/x86/entry/common.c:391
entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124
RIP: 0023:0xf7f00c79
RSP: 002b:00000000f76db01c EFLAGS: 00000296 ORIG_RAX: 0000000000000150
RAX: ffffffffffffffda RBX: 00000000208a7f88 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 00000000ffffffff RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
config.txt
raw.log

syzbot

unread,
Oct 29, 2017, 5:24:02 PM10/29/17
to linux-...@vger.kernel.org, mi...@kernel.org, ros...@goodmis.org, syzkall...@googlegroups.com
syzkaller has found reproducer for the following crash on
36ef71cae353f88fd6e095e2aaa3e5953af1685d
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


WARNING: CPU: 0 PID: 2995 at kernel/tracepoint.c:210 tracepoint_add_func
kernel/tracepoint.c:210 [inline]
WARNING: CPU: 0 PID: 2995 at kernel/tracepoint.c:210
tracepoint_probe_register_prio+0x397/0x9a0 kernel/tracepoint.c:283
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 2995 Comm: syzkaller857118 Not tainted
4.14.0-rc5-next-20171018+ #36
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1c4/0x1e0 kernel/panic.c:546
report_bug+0x211/0x2d0 lib/bug.c:183
fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:177
do_trap_no_signal arch/x86/kernel/traps.c:211 [inline]
do_trap+0x260/0x390 arch/x86/kernel/traps.c:260
do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:297
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:310
invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905
RIP: 0010:tracepoint_add_func kernel/tracepoint.c:210 [inline]
RIP: 0010:tracepoint_probe_register_prio+0x397/0x9a0 kernel/tracepoint.c:283
RSP: 0018:ffff8801d1d1f6c0 EFLAGS: 00010293
RAX: ffff8801d22e8540 RBX: 00000000ffffffef RCX: ffffffff81710f07
RDX: 0000000000000000 RSI: ffffffff85b679c0 RDI: ffff8801d5f19818
RBP: ffff8801d1d1f7c8 R08: ffffffff81710c10 R09: 0000000000000004
R10: ffff8801d1d1f6b0 R11: 0000000000000003 R12: ffffffff817597f0
R13: 0000000000000000 R14: 00000000ffffffff R15: ffff8801d1d1f7a0
tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304
register_trace_block_rq_insert include/trace/events/block.h:191 [inline]
blk_register_tracepoints+0x1e/0x2f0 kernel/trace/blktrace.c:1043
do_blk_trace_setup+0xa10/0xcf0 kernel/trace/blktrace.c:542
blk_trace_setup+0xbd/0x180 kernel/trace/blktrace.c:564
sg_ioctl+0xc71/0x2d90 drivers/scsi/sg.c:1089
vfs_ioctl fs/ioctl.c:45 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x444339
RSP: 002b:00007ffe05bb5b18 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006d66c0 RCX: 0000000000444339
RDX: 000000002084cf90 RSI: 00000000c0481273 RDI: 0000000000000009
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffff
R13: 00000000c0481273 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

config.txt
raw.log
repro.txt
repro.c

Steven Rostedt

unread,
Oct 31, 2017, 6:21:20 PM10/31/17
to syzbot, linux-...@vger.kernel.org, mi...@kernel.org, syzkall...@googlegroups.com, Mathieu Desnoyers, Jens Axboe
On Sun, 29 Oct 2017 14:24:01 -0700
syzbot <bot+2acf619eef45c8f8b3...@syzkaller.appspotmail.com> wrote:

> syzkaller has found reproducer for the following crash on
> 36ef71cae353f88fd6e095e2aaa3e5953af1685d

So this fuzzer triggers this.

> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> C reproducer is attached
> syzkaller reproducer is attached. See https://goo.gl/kgGztJ
> for information about syzkaller reproducers
>
>
> WARNING: CPU: 0 PID: 2995 at kernel/tracepoint.c:210 tracepoint_add_func
> kernel/tracepoint.c:210 [inline]

Which is this:

old = func_add(&tp_funcs, func, prio);
if (IS_ERR(old)) {
WARN_ON_ONCE(1);
return PTR_ERR(old);
}

Which means that func_add() returned a warning.

The possible warnings are:

if (WARN_ON(!tp_func->func))
return ERR_PTR(-EINVAL);

if (old[nr_probes].func == tp_func->func &&
old[nr_probes].data == tp_func->data)
return ERR_PTR(-EEXIST);

new = allocate_probes(nr_probes + 2);
if (new == NULL)
return ERR_PTR(-ENOMEM);

Which means that either the tp_func->func didn't have a function. I
doubt that from the back trace, it is just the registering of the
tracepoints which should always have func set.

I doubt we ran out of memory here. Possible, but unlikely (this was
reproduced twice with the same path).

Which leaves us with a tracepoint that was registered twice.

There's nothing in register_trace_*() that protects it. The blktrace
code needs to have some protection to know if it registered the
tracepoints once, otherwise this will trigger.


> WARNING: CPU: 0 PID: 2995 at kernel/tracepoint.c:210
> tracepoint_probe_register_prio+0x397/0x9a0 kernel/tracepoint.c:283
> Kernel panic - not syncing: panic_on_warn set ...

It panics because "panic_on_warn" is set and we just did a warning.
I'm guessing the blk_trace_setup should have a mutex or something to
protect this. Atomic counters is not enough.


CPU0 CPU1
---- ----
if (atomic_inc_return(&blk_probes_ref) == 1)
blk_register_tracepoints();

if (atomic_dec_and_test(&blk_probes_ref))

if (atomic_inc_return(&blk_probes_ref) == 1)
blk_register_tracepoints();

blk_unregister_tracepoints();

Would cause this to trigger.

-- Steve

Jens Axboe

unread,
Oct 31, 2017, 6:30:44 PM10/31/17
to Steven Rostedt, syzbot, linux-...@vger.kernel.org, mi...@kernel.org, syzkall...@googlegroups.com, Mathieu Desnoyers
This code dates back to:

commit c71a896154119f4ca9e89d6078f5f63ad60ef199
Author: Arnaldo Carvalho de Melo <ac...@redhat.com>
Date: Fri Jan 23 12:06:27 2009 -0200

blktrace: add ftrace plugin

so not really a recent regression :-)

I'll take a look at it.

--
Jens Axboe

Steven Rostedt

unread,
Oct 31, 2017, 7:14:19 PM10/31/17
to Jens Axboe, syzbot, linux-...@vger.kernel.org, mi...@kernel.org, syzkall...@googlegroups.com, Mathieu Desnoyers
On Tue, 31 Oct 2017 16:30:41 -0600
Jens Axboe <ax...@kernel.dk> wrote:

> This code dates back to:
>
> commit c71a896154119f4ca9e89d6078f5f63ad60ef199
> Author: Arnaldo Carvalho de Melo <ac...@redhat.com>
> Date: Fri Jan 23 12:06:27 2009 -0200
>
> blktrace: add ftrace plugin
>
> so not really a recent regression :-)

How many people run two instances of blktrace? ;-)

Love fuzzers!

>
> I'll take a look at it.
>

Thanks.

-- Steve


Jens Axboe

unread,
Nov 4, 2017, 1:26:23 PM11/4/17
to Steven Rostedt, syzbot, linux-...@vger.kernel.org, mi...@kernel.org, syzkall...@googlegroups.com, Mathieu Desnoyers
On 10/31/2017 05:14 PM, Steven Rostedt wrote:
> On Tue, 31 Oct 2017 16:30:41 -0600
> Jens Axboe <ax...@kernel.dk> wrote:
>
>> This code dates back to:
>>
>> commit c71a896154119f4ca9e89d6078f5f63ad60ef199
>> Author: Arnaldo Carvalho de Melo <ac...@redhat.com>
>> Date: Fri Jan 23 12:06:27 2009 -0200
>>
>> blktrace: add ftrace plugin
>>
>> so not really a recent regression :-)
>
> How many people run two instances of blktrace? ;->
> Love fuzzers!

The core code is fine, the bug is actually in sg which added
hooks for both doing setup/teardown and start/stop of tracing.
This was done bypassing the internal locking...

The below should do the trick. It's a fix for this commit:

commit 6da127ad0918f93ea93678dad62ce15ffed18797
Author: Christof Schmitt <christof...@de.ibm.com>
Date: Fri Jan 11 10:09:43 2008 +0100

blktrace: Add blktrace ioctls to SCSI generic devices


diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 45a3928544ce..ea57dd94b2b2 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -336,7 +336,7 @@ static void blk_trace_cleanup(struct blk_trace *bt)
blk_unregister_tracepoints();
}

-int blk_trace_remove(struct request_queue *q)
+static int __blk_trace_remove(struct request_queue *q)
{
struct blk_trace *bt;

@@ -349,6 +349,17 @@ int blk_trace_remove(struct request_queue *q)

return 0;
}
+
+int blk_trace_remove(struct request_queue *q)
+{
+ int ret;
+
+ mutex_lock(&q->blk_trace_mutex);
+ ret = __blk_trace_remove(q);
+ mutex_unlock(&q->blk_trace_mutex);
+
+ return ret;
+}
EXPORT_SYMBOL_GPL(blk_trace_remove);

static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
@@ -550,9 +561,8 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
return ret;
}

-int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
- struct block_device *bdev,
- char __user *arg)
+static int __blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ struct block_device *bdev, char __user *arg)
{
struct blk_user_trace_setup buts;
int ret;
@@ -571,6 +581,19 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
}
return 0;
}
+
+int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ struct block_device *bdev,
+ char __user *arg)
+{
+ int ret;
+
+ mutex_lock(&q->blk_trace_mutex);
+ ret = __blk_trace_setup(q, name, dev, bdev, arg);
+ mutex_unlock(&q->blk_trace_mutex);
+
+ return ret;
+}
EXPORT_SYMBOL_GPL(blk_trace_setup);

#if defined(CONFIG_COMPAT) && defined(CONFIG_X86_64)
@@ -607,7 +630,7 @@ static int compat_blk_trace_setup(struct request_queue *q, char *name,
}
#endif

-int blk_trace_startstop(struct request_queue *q, int start)
+static int __blk_trace_startstop(struct request_queue *q, int start)
{
int ret;
struct blk_trace *bt = q->blk_trace;
@@ -646,6 +669,17 @@ int blk_trace_startstop(struct request_queue *q, int start)

return ret;
}
+
+int blk_trace_startstop(struct request_queue *q, int start)
+{
+ int ret;
+
+ mutex_lock(&q->blk_trace_mutex);
+ ret = __blk_trace_startstop(q, start);
+ mutex_unlock(&q->blk_trace_mutex);
+
+ return ret;
+}
EXPORT_SYMBOL_GPL(blk_trace_startstop);

/*
@@ -676,7 +710,7 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
switch (cmd) {
case BLKTRACESETUP:
bdevname(bdev, b);
- ret = blk_trace_setup(q, b, bdev->bd_dev, bdev, arg);
+ ret = __blk_trace_setup(q, b, bdev->bd_dev, bdev, arg);
break;
#if defined(CONFIG_COMPAT) && defined(CONFIG_X86_64)
case BLKTRACESETUP32:
@@ -687,10 +721,10 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
case BLKTRACESTART:
start = 1;
case BLKTRACESTOP:
- ret = blk_trace_startstop(q, start);
+ ret = __blk_trace_startstop(q, start);
break;
case BLKTRACETEARDOWN:
- ret = blk_trace_remove(q);
+ ret = __blk_trace_remove(q);
break;
default:
ret = -ENOTTY;
@@ -708,10 +742,14 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
**/
void blk_trace_shutdown(struct request_queue *q)
{
+ mutex_lock(&q->blk_trace_mutex);
+
if (q->blk_trace) {
- blk_trace_startstop(q, 0);
- blk_trace_remove(q);
+ __blk_trace_startstop(q, 0);
+ __blk_trace_remove(q);
}
+
+ mutex_unlock(&q->blk_trace_mutex);
}

#ifdef CONFIG_BLK_CGROUP

--
Jens Axboe

Jens Axboe

unread,
Nov 4, 2017, 1:53:10 PM11/4/17
to Steven Rostedt, syzbot, linux-...@vger.kernel.org, mi...@kernel.org, syzkall...@googlegroups.com, Mathieu Desnoyers
On 11/04/2017 11:26 AM, Jens Axboe wrote:
> On 10/31/2017 05:14 PM, Steven Rostedt wrote:
>> On Tue, 31 Oct 2017 16:30:41 -0600
>> Jens Axboe <ax...@kernel.dk> wrote:
>>
>>> This code dates back to:
>>>
>>> commit c71a896154119f4ca9e89d6078f5f63ad60ef199
>>> Author: Arnaldo Carvalho de Melo <ac...@redhat.com>
>>> Date: Fri Jan 23 12:06:27 2009 -0200
>>>
>>> blktrace: add ftrace plugin
>>>
>>> so not really a recent regression :-)
>>
>> How many people run two instances of blktrace? ;->
>> Love fuzzers!
>
> The core code is fine, the bug is actually in sg which added
> hooks for both doing setup/teardown and start/stop of tracing.
> This was done bypassing the internal locking...
>
> The below should do the trick. It's a fix for this commit:
>
> commit 6da127ad0918f93ea93678dad62ce15ffed18797
> Author: Christof Schmitt <christof...@de.ibm.com>
> Date: Fri Jan 11 10:09:43 2008 +0100
>
> blktrace: Add blktrace ioctls to SCSI generic devices

Forgot the critical bit, updated.


diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 45a3928544ce..206e0e2ace53 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -66,7 +66,8 @@ static struct tracer_flags blk_tracer_flags = {
};

/* Global reference count of probes */
-static atomic_t blk_probes_ref = ATOMIC_INIT(0);
+static DEFINE_MUTEX(blk_probe_mutex);
+static int blk_probes_ref;

static void blk_register_tracepoints(void);
static void blk_unregister_tracepoints(void);
@@ -329,14 +330,29 @@ static void blk_trace_free(struct blk_trace *bt)
kfree(bt);
}

+static void get_probe_ref(void)
+{
+ mutex_lock(&blk_probe_mutex);
+ if (++blk_probes_ref == 1)
+ blk_register_tracepoints();
+ mutex_unlock(&blk_probe_mutex);
+}
+
+static void put_probe_ref(void)
+{
+ mutex_lock(&blk_probe_mutex);
+ if (!--blk_probes_ref)
+ blk_unregister_tracepoints();
+ mutex_unlock(&blk_probe_mutex);
+}
+
static void blk_trace_cleanup(struct blk_trace *bt)
{
blk_trace_free(bt);
- if (atomic_dec_and_test(&blk_probes_ref))
- blk_unregister_tracepoints();
+ put_probe_ref();
}

-int blk_trace_remove(struct request_queue *q)
+static int __blk_trace_remove(struct request_queue *q)
{
struct blk_trace *bt;

@@ -349,6 +365,17 @@ int blk_trace_remove(struct request_queue *q)

return 0;
}
+
+int blk_trace_remove(struct request_queue *q)
+{
+ int ret;
+
+ mutex_lock(&q->blk_trace_mutex);
+ ret = __blk_trace_remove(q);
+ mutex_unlock(&q->blk_trace_mutex);
+
+ return ret;
+}
EXPORT_SYMBOL_GPL(blk_trace_remove);

static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
@@ -538,8 +565,7 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
if (cmpxchg(&q->blk_trace, NULL, bt))
goto err;

- if (atomic_inc_return(&blk_probes_ref) == 1)
- blk_register_tracepoints();
+ get_probe_ref();

ret = 0;
err:
@@ -550,9 +576,8 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
return ret;
}

-int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
- struct block_device *bdev,
- char __user *arg)
+static int __blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ struct block_device *bdev, char __user *arg)
{
struct blk_user_trace_setup buts;
int ret;
@@ -571,6 +596,19 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
}
return 0;
}
+
+int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ struct block_device *bdev,
+ char __user *arg)
+{
+ int ret;
+
+ mutex_lock(&q->blk_trace_mutex);
+ ret = __blk_trace_setup(q, name, dev, bdev, arg);
+ mutex_unlock(&q->blk_trace_mutex);
+
+ return ret;
+}
EXPORT_SYMBOL_GPL(blk_trace_setup);

#if defined(CONFIG_COMPAT) && defined(CONFIG_X86_64)
@@ -607,7 +645,7 @@ static int compat_blk_trace_setup(struct request_queue *q, char *name,
}
#endif

-int blk_trace_startstop(struct request_queue *q, int start)
+static int __blk_trace_startstop(struct request_queue *q, int start)
{
int ret;
struct blk_trace *bt = q->blk_trace;
@@ -646,6 +684,17 @@ int blk_trace_startstop(struct request_queue *q, int start)

return ret;
}
+
+int blk_trace_startstop(struct request_queue *q, int start)
+{
+ int ret;
+
+ mutex_lock(&q->blk_trace_mutex);
+ ret = __blk_trace_startstop(q, start);
+ mutex_unlock(&q->blk_trace_mutex);
+
+ return ret;
+}
EXPORT_SYMBOL_GPL(blk_trace_startstop);

/*
@@ -676,7 +725,7 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
switch (cmd) {
case BLKTRACESETUP:
bdevname(bdev, b);
- ret = blk_trace_setup(q, b, bdev->bd_dev, bdev, arg);
+ ret = __blk_trace_setup(q, b, bdev->bd_dev, bdev, arg);
break;
#if defined(CONFIG_COMPAT) && defined(CONFIG_X86_64)
case BLKTRACESETUP32:
@@ -687,10 +736,10 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
case BLKTRACESTART:
start = 1;
case BLKTRACESTOP:
- ret = blk_trace_startstop(q, start);
+ ret = __blk_trace_startstop(q, start);
break;
case BLKTRACETEARDOWN:
- ret = blk_trace_remove(q);
+ ret = __blk_trace_remove(q);
break;
default:
ret = -ENOTTY;
@@ -708,10 +757,14 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
**/
void blk_trace_shutdown(struct request_queue *q)
{
+ mutex_lock(&q->blk_trace_mutex);
+
if (q->blk_trace) {
- blk_trace_startstop(q, 0);
- blk_trace_remove(q);
+ __blk_trace_startstop(q, 0);
+ __blk_trace_remove(q);
}
+
+ mutex_unlock(&q->blk_trace_mutex);
}

#ifdef CONFIG_BLK_CGROUP
@@ -1558,9 +1611,7 @@ static int blk_trace_remove_queue(struct request_queue *q)
if (bt == NULL)
return -EINVAL;

- if (atomic_dec_and_test(&blk_probes_ref))
- blk_unregister_tracepoints();
-
+ put_probe_ref();
blk_trace_free(bt);
return 0;
}
@@ -1591,8 +1642,7 @@ static int blk_trace_setup_queue(struct request_queue *q,
if (cmpxchg(&q->blk_trace, NULL, bt))
goto free_bt;

- if (atomic_inc_return(&blk_probes_ref) == 1)
- blk_register_tracepoints();
+ get_probe_ref();
return 0;

free_bt:

--
Jens Axboe

Reply all
Reply to author
Forward
0 new messages