# git rev-parse -q --verify d1dc87763f406d4e67caf16dbe438a5647692395^{commit} d1dc87763f406d4e67caf16dbe438a5647692395 already have revision, skipping fetch # git checkout -q -f -B kisskb d1dc87763f406d4e67caf16dbe438a5647692395 # git clean -qxdf # < git log -1 # commit d1dc87763f406d4e67caf16dbe438a5647692395 # Author: Stephen Brennan # Date: Thu May 19 09:50:30 2022 +0100 # # assoc_array: Fix BUG_ON during garbage collect # # A rare BUG_ON triggered in assoc_array_gc: # # [3430308.818153] kernel BUG at lib/assoc_array.c:1609! # # Which corresponded to the statement currently at line 1593 upstream: # # BUG_ON(assoc_array_ptr_is_meta(p)); # # Using the data from the core dump, I was able to generate a userspace # reproducer[1] and determine the cause of the bug. # # [1]: https://github.com/brenns10/kernel_stuff/tree/master/assoc_array_gc # # After running the iterator on the entire branch, an internal tree node # looked like the following: # # NODE (nr_leaves_on_branch: 3) # SLOT [0] NODE (2 leaves) # SLOT [1] NODE (1 leaf) # SLOT [2..f] NODE (empty) # # In the userspace reproducer, the pr_devel output when compressing this # node was: # # -- compress node 0x5607cc089380 -- # free=0, leaves=0 # [0] retain node 2/1 [nx 0] # [1] fold node 1/1 [nx 0] # [2] fold node 0/1 [nx 2] # [3] fold node 0/2 [nx 2] # [4] fold node 0/3 [nx 2] # [5] fold node 0/4 [nx 2] # [6] fold node 0/5 [nx 2] # [7] fold node 0/6 [nx 2] # [8] fold node 0/7 [nx 2] # [9] fold node 0/8 [nx 2] # [10] fold node 0/9 [nx 2] # [11] fold node 0/10 [nx 2] # [12] fold node 0/11 [nx 2] # [13] fold node 0/12 [nx 2] # [14] fold node 0/13 [nx 2] # [15] fold node 0/14 [nx 2] # after: 3 # # At slot 0, an internal node with 2 leaves could not be folded into the # node, because there was only one available slot (slot 0). Thus, the # internal node was retained. At slot 1, the node had one leaf, and was # able to be folded in successfully. The remaining nodes had no leaves, # and so were removed. By the end of the compression stage, there were 14 # free slots, and only 3 leaf nodes. The tree was ascended and then its # parent node was compressed. When this node was seen, it could not be # folded, due to the internal node it contained. # # The invariant for compression in this function is: whenever # nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT, the node should contain all # leaf nodes. The compression step currently cannot guarantee this, given # the corner case shown above. # # To fix this issue, retry compression whenever we have retained a node, # and yet nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT. This second # compression will then allow the node in slot 1 to be folded in, # satisfying the invariant. Below is the output of the reproducer once the # fix is applied: # # -- compress node 0x560e9c562380 -- # free=0, leaves=0 # [0] retain node 2/1 [nx 0] # [1] fold node 1/1 [nx 0] # [2] fold node 0/1 [nx 2] # [3] fold node 0/2 [nx 2] # [4] fold node 0/3 [nx 2] # [5] fold node 0/4 [nx 2] # [6] fold node 0/5 [nx 2] # [7] fold node 0/6 [nx 2] # [8] fold node 0/7 [nx 2] # [9] fold node 0/8 [nx 2] # [10] fold node 0/9 [nx 2] # [11] fold node 0/10 [nx 2] # [12] fold node 0/11 [nx 2] # [13] fold node 0/12 [nx 2] # [14] fold node 0/13 [nx 2] # [15] fold node 0/14 [nx 2] # internal nodes remain despite enough space, retrying # -- compress node 0x560e9c562380 -- # free=14, leaves=1 # [0] fold node 2/15 [nx 0] # after: 3 # # Changes # ======= # DH: # - Use false instead of 0. # - Reorder the inserted lines in a couple of places to put retained before # next_slot. # # ver #2) # - Fix typo in pr_devel, correct comparison to "<=" # # Fixes: 3cb989501c26 ("Add a generic associative array implementation.") # Cc: # Signed-off-by: Stephen Brennan # Signed-off-by: David Howells # cc: Andrew Morton # cc: keyrings@vger.kernel.org # Link: https://lore.kernel.org/r/20220511225517.407935-1-stephen.s.brennan@oracle.com/ # v1 # Link: https://lore.kernel.org/r/20220512215045.489140-1-stephen.s.brennan@oracle.com/ # v2 # Reviewed-by: Jarkko Sakkinen # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sh4-linux/bin/sh4-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sh4-linux/bin/sh4-linux-ld --version # < git log --format=%s --max-count=1 d1dc87763f406d4e67caf16dbe438a5647692395 # < make -s -j 32 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sh4-linux/bin/sh4-linux- se7619_defconfig # < make -s -j 32 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sh4-linux/bin/sh4-linux- help # make -s -j 32 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sh4-linux/bin/sh4-linux- olddefconfig # make -s -j 32 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sh4-linux/bin/sh4-linux- Generating include/generated/machtypes.h :1517:2: warning: #warning syscall clone3 not implemented [-Wcpp] /kisskb/src/arch/sh/kernel/machvec.c: In function 'sh_mv_setup': /kisskb/src/arch/sh/kernel/machvec.c:105:33: warning: array subscript 'struct sh_machine_vector[0]' is partly outside array bounds of 'long int[1]' [-Warray-bounds] 105 | sh_mv = *(struct sh_machine_vector *)&__machvec_start; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /kisskb/src/arch/sh/kernel/machvec.c:13: /kisskb/src/arch/sh/include/asm/sections.h:7:13: note: while referencing '__machvec_start' 7 | extern long __machvec_start, __machvec_end; | ^~~~~~~~~~~~~~~ In file included from /kisskb/src/arch/sh/include/asm/hw_irq.h:6, from /kisskb/src/include/linux/irq.h:594, from /kisskb/src/include/asm-generic/hardirq.h:17, from /kisskb/src/arch/sh/include/asm/hardirq.h:9, from /kisskb/src/include/linux/hardirq.h:11, from /kisskb/src/include/linux/interrupt.h:11, from /kisskb/src/include/linux/serial_core.h:13, from /kisskb/src/include/linux/serial_sci.h:6, from /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:11: /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:105:31: note: in expansion of macro '_INTC_ARRAY' 105 | _INTC_ARRAY(vectors), _INTC_ARRAY(groups), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:15: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:106:9: note: in expansion of macro '_INTC_ARRAY' 106 | _INTC_ARRAY(mask_regs), _INTC_ARRAY(prio_regs), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:15: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:107:9: note: in expansion of macro '_INTC_ARRAY' 107 | _INTC_ARRAY(sense_regs), _INTC_ARRAY(ack_regs), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:15: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:107:34: note: in expansion of macro '_INTC_ARRAY' 107 | _INTC_ARRAY(sense_regs), _INTC_ARRAY(ack_regs), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:15: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/mm/oom_kill.c:60:25: warning: 'vm_oom_kill_table' defined but not used [-Wunused-variable] 60 | static struct ctl_table vm_oom_kill_table[] = { | ^~~~~~~~~~~~~~~~~ /kisskb/src/drivers/tty/serial/sh-sci.c: In function 'sci_remap_port': /kisskb/src/drivers/tty/serial/sh-sci.c:2651:26: warning: unused variable 'sport' [-Wunused-variable] 2651 | struct sci_port *sport = to_sci_port(port); | ^~~~~ Completed OK # rm -rf /kisskb/build/linus_se7619_defconfig_sh4-gcc11 # Build took: 0:00:19.510751