From: Michael Bringmann <mwb@linux.vnet.ibm.com>
To: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>,
linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org
Cc: Rob Herring <robh@kernel.org>,
Thomas Falcon <tlfalcon@linux.vnet.ibm.com>,
Nicholas Piggin <npiggin@gmail.com>,
Paul Mackerras <paulus@samba.org>,
Nathan Lynch <nathanl@linux.vnet.ibm.com>,
"Juliet M. Kim" <minkim@linux.vnet.ibm.com>
Subject: Re: [PATCH] powerpc/pseries: Fix dn reference error in dlpar_cpu_remove_by_index
Date: Wed, 20 Feb 2019 14:18:56 -0600 [thread overview]
Message-ID: <8bc3e665-828f-8247-0778-56d7ee045e53@linux.vnet.ibm.com> (raw)
In-Reply-To: <a7986146-f09d-6d40-63f9-8e7307fc2609@linux.vnet.ibm.com>
On 2/19/19 2:03 PM, Tyrel Datwyler wrote:
> On 02/19/2019 07:46 AM, Michael Bringmann wrote:
>> powerpc/pseries: Fix dn reference error in dlpar_cpu_remove_by_index()
>>
>> A reference to the device node of the CPU to be removed is released
>> upon successful removal of the associated CPU device. If the call
>> to remove the CPU device fails, dlpar_cpu_remove_by_index() still
>> frees the reference and this leads to miscomparisons and/or
>> addressing errors later on.
>>
>> This problem may be observed when trying to DLPAR 'hot-remove' a CPU
>> from a system that has only a single CPU. The operation will fail
>> because there is no other CPU to which the kernel operations may be
>> migrated, but the refcount will still be decremented.
>>
>> Signed-off-by: Michael Bringmann <mwb@linux.vnet.ibm.com>
>>
>>
>> diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
>> index 97feb6e..9537bb9 100644
>> --- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
>> +++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
>> @@ -635,7 +635,8 @@ static int dlpar_cpu_remove_by_index(u32 drc_index)
>> }
>>
>> rc = dlpar_cpu_remove(dn, drc_index);
>> - of_node_put(dn);
>> + if (!rc)
>> + of_node_put(dn);
>> return rc;
>> }
>>
>
> NACK!
>
> The logic here is wrong. Here is the full function.
>
> static int dlpar_cpu_remove_by_index(u32 drc_index)
> {
> struct device_node *dn;
> int rc;
>
> dn = cpu_drc_index_to_dn(drc_index);
> if (!dn) {
> pr_warn("Cannot find CPU (drc index %x) to remove\n",
> drc_index);
> return -ENODEV;
> }
>
> rc = dlpar_cpu_remove(dn, drc_index);
> of_node_put(dn);
> return rc;
> }
>
> The call to cpu_drc_index_to_dn() returns a device_node with the reference count
> incremented. So, regardless of the success or failure of the call to
> dlpar_cpu_remove() you need to release that reference.
>
> If there is a reference counting issue it is somewhere else.
Okay. Withdrawn while we look some more.
> -Tyrel
--
Michael W. Bringmann
Linux Technology Center
IBM Corporation
Tie-Line 363-5196
External: (512) 286-5196
Cell: (512) 466-0650
mwb@linux.vnet.ibm.com
prev parent reply other threads:[~2019-02-20 20:21 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-19 15:46 [PATCH] powerpc/pseries: Fix dn reference error in dlpar_cpu_remove_by_index Michael Bringmann
2019-02-19 20:03 ` Tyrel Datwyler
2019-02-20 20:18 ` Michael Bringmann [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8bc3e665-828f-8247-0778-56d7ee045e53@linux.vnet.ibm.com \
--to=mwb@linux.vnet.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=minkim@linux.vnet.ibm.com \
--cc=nathanl@linux.vnet.ibm.com \
--cc=npiggin@gmail.com \
--cc=paulus@samba.org \
--cc=robh@kernel.org \
--cc=tlfalcon@linux.vnet.ibm.com \
--cc=tyreld@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).