]> git.baikalelectronics.ru Git - kernel.git/commit
cpu/hotplug: Reset node state after operation
authorThomas Gleixner <tglx@linutronix.de>
Sat, 21 Oct 2017 14:06:52 +0000 (16:06 +0200)
committerThomas Gleixner <tglx@linutronix.de>
Sat, 21 Oct 2017 14:11:30 +0000 (16:11 +0200)
commit6075145eb619dde105e7476befba52b18ca1c556
tree438651f8828b1e227b2391a930e7ec74d8643f57
parent18aea357f3e28ce0e8111d8ed08bc8f876b92c43
cpu/hotplug: Reset node state after operation

The recent rework of the cpu hotplug internals changed the usage of the per
cpu state->node field, but missed to clean it up after usage.

So subsequent hotplug operations use the stale pointer from a previous
operation and hand it into the callback functions. The callbacks then
dereference a pointer which either belongs to a different facility or
points to freed and potentially reused memory. In either case data
corruption and crashes are the obvious consequence.

Reset the node and the last pointers in the per cpu state to NULL after the
operation which set them has completed.

Fixes: 1e2ceebe06ab ("smp/hotplug: Allow external multi-instance rollback")
Reported-by: Tvrtko Ursulin <tursulin@ursulin.net>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1710211606130.3213@nanos
kernel/cpu.c