This is a note to let you know that I've just added the patch titled
x86: uv: XPC receive message reuse triggers invalid BUG_ON()
to the 2.6.32-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-uv-xpc-receive-message-reuse-triggers-invalid-bug_on.patch
and it can be found in the queue-2.6.32 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 046d6c563b1c6226bbf0f84e5b2413ad8ab921a1 Mon Sep 17 00:00:00 2001
From: Robin Holt <[email protected]>
Date: Tue, 15 Dec 2009 16:47:59 -0800
Subject: x86: uv: XPC receive message reuse triggers invalid BUG_ON()
From: Robin Holt <[email protected]>
commit 046d6c563b1c6226bbf0f84e5b2413ad8ab921a1 upstream.
This was a difficult bug to trip. XPC was in the middle of sending an
acknowledgement for a received message.
In xpc_received_payload_uv():
.
ret = xpc_send_gru_msg(ch->sn.uv.cached_notify_gru_mq_desc, msg,
sizeof(struct xpc_notify_mq_msghdr_uv));
if (ret != xpSuccess)
XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
msg->hdr.msg_slot_number += ch->remote_nentries;
at the point in xpc_send_gru_msg() where the hardware has dispatched the
acknowledgement, the remote side is able to reuse the message structure
and send a message with a different slot number. This problem is made
worse by interrupts.
The adjustment of msg_slot_number and the BUG_ON in
xpc_handle_notify_mq_msg_uv() which verifies the msg_slot_number is
consistent are only used for debug purposes. Since a fix for this that
preserves the debug functionality would either have to infringe upon the
payload or allocate another structure just for debug, I decided to remove
it entirely.
Signed-off-by: Robin Holt <[email protected]>
Cc: Jack Steiner <[email protected]>
Cc: Ingo Molnar <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/misc/sgi-xp/xpc_uv.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -1441,7 +1441,6 @@ xpc_handle_notify_mq_msg_uv(struct xpc_p
msg_slot = ch_uv->recv_msg_slots +
(msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
- BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
BUG_ON(msg_slot->hdr.size != 0);
memcpy(msg_slot, msg, msg->hdr.size);
@@ -1665,8 +1664,6 @@ xpc_received_payload_uv(struct xpc_chann
sizeof(struct xpc_notify_mq_msghdr_uv));
if (ret != xpSuccess)
XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
-
- msg->hdr.msg_slot_number += ch->remote_nentries;
}
static struct xpc_arch_operations xpc_arch_ops_uv = {
Patches currently in stable-queue which might be from [email protected] are
queue-2.6.32/sgi-xpc-xpc-fails-to-discover-partitions-with-all-nasids-above-128.patch
queue-2.6.32/x86-uv-xpc-receive-message-reuse-triggers-invalid-bug_on.patch
queue-2.6.32/uv-xpc-pass-nasid-instead-of-nid-to-gru_create_message_queue.patch
queue-2.6.32/x86-uv-xpc_make_first_contact-hang-due-to-not-accepting-active-state.patch
queue-2.6.32/limit-sysctl_tcp_mem-and-sysctl_udp_mem-initializers-to-prevent-integer-overflows.patch
queue-2.6.32/x86-uv-xpc-null-deref-when-mesq-becomes-empty.patch
queue-2.6.32/x86-uv-update-xpc-to-handle-updated-bios-interface.patch
queue-2.6.32/x86-uv-xpc-needs-to-provide-an-abstraction-for-uv_gpa.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
