hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/21064 -------------------------------- resctrl_online_domain() returns early for the memory bandwidth resource when the software controller is in use, on the assumption that this resource only holds a configuration. x86 monitors bandwidth at the L3 cache, so that assumption holds there. MPAM monitors bandwidth at the memory-side MSC, and the driver exports the resource with mon_capable set. domain_setup_mon_state() therefore never allocates d->mbm_total for that domain, and INIT_DELAYED_WORK(&d->mbm_over, ...) never runs. Two paths reach the uninitialised domain. rdt_get_tree() sets up an overflow handler for every resource whose bandwidth monitoring is enabled, so mbm_setup_overflow_handler() queues d->mbm_over, whose timer function is still zero: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 144 at kernel/workqueue.c:2144 __queue_delayed_work+0xb8/0xe8 ... mbm_setup_overflow_handler resctrl_setup_dom_overflow resctrl_arch_setup_res_mbm_over rdt_get_tree followed by the workqueue.c:2146 warning for the same reason. The domain's monitoring event is QOS_L3_MBM_TOTAL_EVENT_ID, so get_mbm_state() returns &d->mbm_total[idx]. __mon_event_count() zeroes that entry for the event file created with the domain, and d->mbm_total is NULL: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000300 pc : __mon_event_count+0x90/0x118 Workqueue: events smp_call_on_cpu_callback 0x300 is 32 * sizeof(struct mbm_state) from NULL, the index a monitoring group holding RMID 32 produces on the 8-CPU topology. Creating a monitoring group gives it such an RMID, so the dereference happens on the first read of its mbm_total_bytes file. Run the monitor setup for the memory bandwidth resource when it is mon_capable, keeping mba_sc_domain_allocate() first. The domain then reaches domain_setup_mon_state() and INIT_DELAYED_WORK() as the L2 and L3 domains do. Only MPAM systems are affected: x86 does not set mon_capable on this resource, and the early return matches its layout. Fixes: f193e049f4f2 ("fs/resctrl: Add arch-specific MBM overflow setup helpers") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> --- fs/resctrl/rdtgroup.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 3c55a7b2ead1..e21a007722f1 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -4173,9 +4173,17 @@ int resctrl_online_domain(struct rdt_resource *r, struct rdt_domain *d) mutex_lock(&rdtgroup_mutex); if (supports_mba_mbps() && r->rid == RDT_RESOURCE_MBA) { - /* RDT_RESOURCE_MBA is never mon_capable */ err = mba_sc_domain_allocate(r, d); - goto out_unlock; + if (err) + goto out_unlock; + + /* + * MPAM's memory-side MSC has MBWU counters, so MBA can be + * mon_capable even when mba_sc is in use. Continue with the + * monitor state and overflow handler setup below. + */ + if (!r->mon_capable) + goto out_unlock; } if (!r->mon_capable) -- 2.34.1