lockdep: Fix lock_chain::base size

lock_chain::base is used to store an index into the chain_hlocks[]
array, however that array contains more elements than can be indexed
using the u16.

Change the lock_chain structure to use a bitfield to encode the data
it needs and add BUILD_BUG_ON() assertions to check the fields are
wide enough.

Also, for DEBUG_LOCKDEP, assert that we don't run out of elements of
that array; as that would wreck the collision detectoring.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alfredo Alvarez Fernandez <alfredoalvarezfernandez@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sedat Dilek <sedat.dilek@gmail.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20160330093659.GS3408@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>

3 files changed, 30 insertions, 4 deletions

diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index d026b190c530..d10ef06971b5 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -196,9 +196,11 @@ struct lock_list {
  * We record lock dependency chains, so that we can cache them:
  */
 struct lock_chain {
-        u8                              irq_context;
-        u8                              depth;
-        u16                             base;
+        /* see BUILD_BUG_ON()s in lookup_chain_cache() */
+        unsigned int                    irq_context :  2,
+                                        depth       :  6,
+                                        base        : 24;
+        /* 4 byte hole */
         struct hlist_node               entry;
         u64                             chain_key;
 };
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index beb06f604420..78c1c0ee6dc1 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -2176,15 +2176,37 @@ cache_hit:
         chain->irq_context = hlock->irq_context;
         i = get_first_held_lock(curr, hlock);
         chain->depth = curr->lockdep_depth + 1 - i;
+
+        BUILD_BUG_ON((1UL << 24) <= ARRAY_SIZE(chain_hlocks));
+        BUILD_BUG_ON((1UL << 6)  <= ARRAY_SIZE(curr->held_locks));
+        BUILD_BUG_ON((1UL << 8*sizeof(chain_hlocks[0])) <= ARRAY_SIZE(lock_classes));
+
         if (likely(nr_chain_hlocks + chain->depth <= MAX_LOCKDEP_CHAIN_HLOCKS)) {
                 chain->base = nr_chain_hlocks;
-                nr_chain_hlocks += chain->depth;
                 for (j = 0; j < chain->depth - 1; j++, i++) {
                         int lock_id = curr->held_locks[i].class_idx - 1;
                         chain_hlocks[chain->base + j] = lock_id;
                 }
                 chain_hlocks[chain->base + j] = class - lock_classes;
         }
+
+        if (nr_chain_hlocks < MAX_LOCKDEP_CHAIN_HLOCKS)
+                nr_chain_hlocks += chain->depth;
+
+#ifdef CONFIG_DEBUG_LOCKDEP
+        /*
+         * Important for check_no_collision().
+         */
+        if (unlikely(nr_chain_hlocks > MAX_LOCKDEP_CHAIN_HLOCKS)) {
+                if (debug_locks_off_graph_unlock())
+                        return 0;
+
+                print_lockdep_off("BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!");
+                dump_stack();
+                return 0;
+        }
+#endif
+
         hlist_add_head_rcu(&chain->entry, hash_head);
         debug_atomic_inc(chain_lookup_misses);
         inc_chains();
diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
index dbb61a302548..a0f61effad25 100644
--- a/kernel/locking/lockdep_proc.c
+++ b/kernel/locking/lockdep_proc.c
@@ -141,6 +141,8 @@ static int lc_show(struct seq_file *m, void *v)
         int i;
 
         if (v == SEQ_START_TOKEN) {
+                if (nr_chain_hlocks > MAX_LOCKDEP_CHAIN_HLOCKS)
+                        seq_printf(m, "(buggered) ");
                 seq_printf(m, "all lock chains:\n");
                 return 0;
         }