Messages in this thread | | | Date | Sun, 22 Oct 2017 11:22:18 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH] cpu/hotplug: Reset node state after operation |
| |
On Sat, Oct 21, 2017 at 04:06:52PM +0200, Thomas Gleixner wrote: > The recent rework of the cpu hotplug internals changed the usage of the per > cpu state->node field, but missed to clean it up after usage. > > So subsequent hotplug operations use the stale pointer from a previous > operation and hand it into the callback functions. The callbacks then > dereference a pointer which either belongs to a different facility or > points to freed and potentially reused memory. In either case data > corruption and crashes are the obvious consequence. > > Reset the node and the last pointers in the per cpu state to NULL after the > operation which set them has completed. > > Fixes: 96abb968549c ("smp/hotplug: Allow external multi-instance rollback") > Reported-by: Tvrtko Ursulin <tursulin@ursulin.net> > Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Thanks for digging into that during the conf :-) And sorry for wrecking that.
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> --- > kernel/cpu.c | 5 +++++ > 1 file changed, 5 insertions(+) > > --- a/kernel/cpu.c > +++ b/kernel/cpu.c > @@ -632,6 +632,11 @@ cpuhp_invoke_ap_callback(int cpu, enum c > __cpuhp_kick_ap(st); > } > > + /* > + * Clean up the leftovers so the next hotplug operation wont use stale > + * data. > + */ > + st->node = st->last = NULL; > return ret; > } >
| |