1 files changed, 61 insertions, 3 deletions

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 94af1fe56bb4..2f76193c3489 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -130,7 +130,7 @@ struct buffer_page {
 static inline void free_buffer_page(struct buffer_page *bpage)
 {
         if (bpage->page)
-                __free_page(bpage->page);
+                free_page((unsigned long)bpage->page);
         kfree(bpage);
 }
 
@@ -966,7 +966,9 @@ rb_add_time_stamp(struct ring_buffer_per_cpu *cpu_buffer,
         if (unlikely(*delta > (1ULL << 59) && !once++)) {
                 printk(KERN_WARNING "Delta way too big! %llu"
                        " ts=%llu write stamp = %llu\n",
-                       *delta, *ts, cpu_buffer->write_stamp);
+                       (unsigned long long)*delta,
+                       (unsigned long long)*ts,
+                       (unsigned long long)cpu_buffer->write_stamp);
                 WARN_ON(1);
         }
 
@@ -1020,8 +1022,23 @@ rb_reserve_next_event(struct ring_buffer_per_cpu *cpu_buffer,
         struct ring_buffer_event *event;
         u64 ts, delta;
         int commit = 0;
+        int nr_loops = 0;
 
  again:
+        /*
+         * We allow for interrupts to reenter here and do a trace.
+         * If one does, it will cause this original code to loop
+         * back here. Even with heavy interrupts happening, this
+         * should only happen a few times in a row. If this happens
+         * 1000 times in a row, there must be either an interrupt
+         * storm or we have something buggy.
+         * Bail!
+         */
+        if (unlikely(++nr_loops > 1000)) {
+                RB_WARN_ON(cpu_buffer, 1);
+                return NULL;
+        }
+
         ts = ring_buffer_time_stamp(cpu_buffer->cpu);
 
         /*
@@ -1043,7 +1060,7 @@ rb_reserve_next_event(struct ring_buffer_per_cpu *cpu_buffer,
 
                 /* Did the write stamp get updated already? */
                 if (unlikely(ts < cpu_buffer->write_stamp))
-                        goto again;
+                        delta = 0;
 
                 if (test_time_stamp(delta)) {
 
@@ -1530,10 +1547,23 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
 {
         struct buffer_page *reader = NULL;
         unsigned long flags;
+        int nr_loops = 0;
 
         spin_lock_irqsave(&cpu_buffer->lock, flags);
 
  again:
+        /*
+         * This should normally only loop twice. But because the
+         * start of the reader inserts an empty page, it causes
+         * a case where we will loop three times. There should be no
+         * reason to loop four times (that I know of).
+         */
+        if (unlikely(++nr_loops > 3)) {
+                RB_WARN_ON(cpu_buffer, 1);
+                reader = NULL;
+                goto out;
+        }
+
         reader = cpu_buffer->reader_page;
 
         /* If there's more to read, return this page */
@@ -1663,6 +1693,7 @@ ring_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts)
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_event *event;
         struct buffer_page *reader;
+        int nr_loops = 0;
 
         if (!cpu_isset(cpu, buffer->cpumask))
                 return NULL;
@@ -1670,6 +1701,19 @@ ring_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts)
         cpu_buffer = buffer->buffers[cpu];
 
  again:
+        /*
+         * We repeat when a timestamp is encountered. It is possible
+         * to get multiple timestamps from an interrupt entering just
+         * as one timestamp is about to be written. The max times
+         * that this can happen is the number of nested interrupts we
+         * can have.  Nesting 10 deep of interrupts is clearly
+         * an anomaly.
+         */
+        if (unlikely(++nr_loops > 10)) {
+                RB_WARN_ON(cpu_buffer, 1);
+                return NULL;
+        }
+
         reader = rb_get_reader_page(cpu_buffer);
         if (!reader)
                 return NULL;
@@ -1720,6 +1764,7 @@ ring_buffer_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
         struct ring_buffer *buffer;
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_event *event;
+        int nr_loops = 0;
 
         if (ring_buffer_iter_empty(iter))
                 return NULL;
@@ -1728,6 +1773,19 @@ ring_buffer_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
         buffer = cpu_buffer->buffer;
 
  again:
+        /*
+         * We repeat when a timestamp is encountered. It is possible
+         * to get multiple timestamps from an interrupt entering just
+         * as one timestamp is about to be written. The max times
+         * that this can happen is the number of nested interrupts we
+         * can have. Nesting 10 deep of interrupts is clearly
+         * an anomaly.
+         */
+        if (unlikely(++nr_loops > 10)) {
+                RB_WARN_ON(cpu_buffer, 1);
+                return NULL;
+        }
+
         if (rb_per_cpu_empty(cpu_buffer))
                 return NULL;