)]}'
{
  "commit": "12bc403e965834d97d72c3d2b7502b6d3f3de770",
  "tree": "5b3f7df5c6d47ba296f17d2c1591eb4452502fd4",
  "parents": [
    "6ee26e24ad545e6e388fbfb3d62c9c792bb6480d"
  ],
  "author": {
    "name": "Tirupathi Reddy",
    "email": "tirupath@codeaurora.org",
    "time": "Tue Apr 23 20:25:55 2013 +0530"
  },
  "committer": {
    "name": "Gerrit - the friendly Code Review server",
    "email": "code-review@localhost",
    "time": "Thu Jun 06 03:13:46 2013 -0700"
  },
  "message": "timer: Don\u0027t reinitialize the cpu base lock during CPU_UP_PREPARE\n\nAn inactive timer\u0027s base can refer to a offline cpu\u0027s base.\n\nIn the current code, cpu_base\u0027s lock is blindly reinitialized\neach time a CPU is brought up. If a CPU is brought online\nduring the period that another thread is trying to modify an\ninactive timer on that CPU with holding its timer base lock,\nthen the lock will be reinitialized under its feet. This leads\nto following SPIN_BUG().\n\n\u003c0\u003e BUG: spinlock already unlocked on CPU#3, kworker/u:3/1466\n\u003c0\u003e lock: 0xe3ebe000, .magic: dead4ead, .owner: kworker/u:3/1466,\n .owner_cpu: 1\n\u003c4\u003e [\u003cc0013dc4\u003e] (unwind_backtrace+0x0/0x11c) from [\u003cc026e794\u003e]\n(do_raw_spin_unlock+0x40/0xcc)\n\u003c4\u003e [\u003cc026e794\u003e] (do_raw_spin_unlock+0x40/0xcc) from [\u003cc076c160\u003e]\n(_raw_spin_unlock+0x8/0x30)\n\u003c4\u003e [\u003cc076c160\u003e] (_raw_spin_unlock+0x8/0x30) from [\u003cc009b858\u003e]\n(mod_timer+0x294/0x310)\n\u003c4\u003e [\u003cc009b858\u003e] (mod_timer+0x294/0x310) from [\u003cc00a5e04\u003e]\n(queue_delayed_work_on+0x104/0x120)\n\u003c4\u003e [\u003cc00a5e04\u003e] (queue_delayed_work_on+0x104/0x120) from [\u003cc04eae00\u003e]\n(sdhci_msm_bus_voting+0x88/0x9c)\n\u003c4\u003e [\u003cc04eae00\u003e] (sdhci_msm_bus_voting+0x88/0x9c) from [\u003cc04d8780\u003e]\n(sdhci_disable+0x40/0x48)\n\u003c4\u003e [\u003cc04d8780\u003e] (sdhci_disable+0x40/0x48) from [\u003cc04bf300\u003e]\n(mmc_release_host+0x4c/0xb0)\n\u003c4\u003e [\u003cc04bf300\u003e] (mmc_release_host+0x4c/0xb0) from [\u003cc04c7aac\u003e]\n(mmc_sd_detect+0x90/0xfc)\n\u003c4\u003e [\u003cc04c7aac\u003e] (mmc_sd_detect+0x90/0xfc) from [\u003cc04c2504\u003e]\n(mmc_rescan+0x7c/0x2c4)\n\u003c4\u003e [\u003cc04c2504\u003e] (mmc_rescan+0x7c/0x2c4) from [\u003cc00a6a7c\u003e]\n(process_one_work+0x27c/0x484)\n\u003c4\u003e [\u003cc00a6a7c\u003e] (process_one_work+0x27c/0x484) from [\u003cc00a6e94\u003e]\n(worker_thread+0x210/0x3b0)\n\u003c4\u003e [\u003cc00a6e94\u003e] (worker_thread+0x210/0x3b0) from [\u003cc00aad9c\u003e]\n(kthread+0x80/0x8c)\n\u003c4\u003e [\u003cc00aad9c\u003e] (kthread+0x80/0x8c) from [\u003cc000ea80\u003e]\n(kernel_thread_exit+0x0/0x8)\n\nAs an example, this particular crash occurred when CPU #3 is executing\nmod_timer() on an inactive timer whose base is refered to offlined CPU #2.\nThe code locked the timer_base corresponding to CPU #2. Before it could\nproceed, CPU #2 came online and reinitialized the spinlock corresponding\nto its base. Thus now CPU #3 held a lock which was reinitialized. When\nCPU #3 finally ended up unlocking the old cpu_base corresponding to CPU #2,\nwe hit the above SPIN_BUG().\n\nCPU #0\t\t\tCPU #3\t\t\t\t       CPU #2\n------\t\t\t-------\t\t\t\t       -------\n.....\t\t\t ......\t\t\t\t      \u003cOffline\u003e\n\t\t\tmod_timer()\n\t\t\t lock_timer_base\n\t\t\t  spin_lock_irqsave(\u0026base-\u003elock)\n\ncpu_up(2)\t\t .....\t\t\t\t        ......\n\t\t\t\t\t\t\t init_timers_cpu()\n.....\t\t \t spin_unlock_irqrestore(\u0026base-\u003elock)     ......\n\t\t\t   \u003cspin_bug\u003e\n\nAllocation of per_cpu timer vector bases is done only once under\n\"tvec_base_done[]\" check. In the current code, spinlock_initialization\nof base-\u003elock isn\u0027t under this check. When a CPU is up each time the base\nlock is reinitialized. Move base spinlock initialization under the check.\n\nCRs-Fixed: 471127\nChange-Id: I73b48440fffb227a60af9180e318c851048530dd\nSigned-off-by: Tirupathi Reddy \u003ctirupath@codeaurora.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ef5ec26dd4968cf5f8bfe705128ff925ec4d9d6d",
      "old_mode": 33188,
      "old_path": "kernel/timer.c",
      "new_id": "02dbb092efa1cf2ccc0db051fb48091b92522e24",
      "new_mode": 33188,
      "new_path": "kernel/timer.c"
    }
  ]
}