From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932134AbdJUOVT (ORCPT ); Sat, 21 Oct 2017 10:21:19 -0400 Received: from terminus.zytor.com ([65.50.211.136]:60441 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932099AbdJUOVR (ORCPT ); Sat, 21 Oct 2017 10:21:17 -0400 Date: Sat, 21 Oct 2017 07:16:47 -0700 From: tip-bot for Thomas Gleixner Message-ID: Cc: mingo@kernel.org, linux-kernel@vger.kernel.org, tglx@linutronix.de, peterz@infradead.org, paulmck@linux.vnet.ibm.com, tursulin@ursulin.net, bigeasy@linutronix.de, boris.ostrovsky@oracle.com, hpa@zytor.com Reply-To: tglx@linutronix.de, linux-kernel@vger.kernel.org, peterz@infradead.org, mingo@kernel.org, bigeasy@linutronix.de, tursulin@ursulin.net, hpa@zytor.com, boris.ostrovsky@oracle.com, paulmck@linux.vnet.ibm.com In-Reply-To: References: To: linux-tip-commits@vger.kernel.org Subject: [tip:smp/urgent] cpu/hotplug: Reset node state after operation Git-Commit-ID: 1f7c70d6b2bc5de301f30456621e1161fddf4242 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 1f7c70d6b2bc5de301f30456621e1161fddf4242 Gitweb: https://git.kernel.org/tip/1f7c70d6b2bc5de301f30456621e1161fddf4242 Author: Thomas Gleixner AuthorDate: Sat, 21 Oct 2017 16:06:52 +0200 Committer: Thomas Gleixner CommitDate: Sat, 21 Oct 2017 16:11:30 +0200 cpu/hotplug: Reset node state after operation The recent rework of the cpu hotplug internals changed the usage of the per cpu state->node field, but missed to clean it up after usage. So subsequent hotplug operations use the stale pointer from a previous operation and hand it into the callback functions. The callbacks then dereference a pointer which either belongs to a different facility or points to freed and potentially reused memory. In either case data corruption and crashes are the obvious consequence. Reset the node and the last pointers in the per cpu state to NULL after the operation which set them has completed. Fixes: 96abb968549c ("smp/hotplug: Allow external multi-instance rollback") Reported-by: Tvrtko Ursulin Signed-off-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Sebastian Andrzej Siewior Cc: Boris Ostrovsky Cc: "Paul E. McKenney" Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1710211606130.3213@nanos --- kernel/cpu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/cpu.c b/kernel/cpu.c index d851df2..04892a8 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -632,6 +632,11 @@ cpuhp_invoke_ap_callback(int cpu, enum cpuhp_state state, bool bringup, __cpuhp_kick_ap(st); } + /* + * Clean up the leftovers so the next hotplug operation wont use stale + * data. + */ + st->node = st->last = NULL; return ret; }