lkml.org 
[lkml]   [2009]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
Subject[patch 8/8] X86: UV - XPC receive message reuse triggers invalid BUG_ON().

This was a difficult bug to trip. XPC was in the middle of sending an
acknowledgement for a received message.

In xpc_received_payload_uv():
..
ret = xpc_send_gru_msg(ch->sn.uv.cached_notify_gru_mq_desc, msg,
sizeof(struct xpc_notify_mq_msghdr_uv));
if (ret != xpSuccess)
XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
msg->hdr.msg_slot_number += ch->remote_nentries;

at the point in xpc_send_gru_msg() where the hardware has dispatched the
acknowledgement, the remote side is able to reuse the message structure
and send a message with a different slot number. This problem is made
worse by interrupts.

The adjustment of msg_slot_number and the BUG_ON in
xpc_handle_notify_mq_msg_uv() which verifies the msg_slot_number is
consistent are only used for debug purposes. Since a fix for this that
preserves the debug functionality would either have to infringe upon
the payload or allocate another structure just for debug, I decided to
remove it entirely.

To: Ingo Molnar <mingo@elte.hu>
To: tglx@linutronix.de
Signed-off-by: Robin Holt <holt@sgi.com>
Cc: Jack Steiner <steiner@sgi.com>
Cc: linux-kernel@vger.kernel.org

---
drivers/misc/sgi-xp/xpc_uv.c | 3 ---
1 file changed, 3 deletions(-)
Index: linux-x86/drivers/misc/sgi-xp/xpc_uv.c
===================================================================
--- linux-x86.orig/drivers/misc/sgi-xp/xpc_uv.c 2009-11-18 22:16:45.000000000 -0600
+++ linux-x86/drivers/misc/sgi-xp/xpc_uv.c 2009-11-18 22:16:45.000000000 -0600
@@ -1428,7 +1428,6 @@ xpc_handle_notify_mq_msg_uv(struct xpc_p
msg_slot = ch_uv->recv_msg_slots +
(msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;

- BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
BUG_ON(msg_slot->hdr.size != 0);

memcpy(msg_slot, msg, msg->hdr.size);
@@ -1652,8 +1651,6 @@ xpc_received_payload_uv(struct xpc_chann
sizeof(struct xpc_notify_mq_msghdr_uv));
if (ret != xpSuccess)
XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
-
- msg->hdr.msg_slot_number += ch->remote_nentries;
}

static struct xpc_arch_operations xpc_arch_ops_uv = {


\
 
 \ /
  Last update: 2009-11-19 18:35    [from the cache]
©2003-2011 Jasper Spaans