From 9f5e559aa8edc220e542f84a5c8391c8b37ab265 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sun, 19 Apr 2015 04:56:03 -0400 Subject: [PATCH] smp: Fix error case handling in smp_call_function_*() Commit 03856e5aef7e ("smp: Fix smp_call_function_single_async() locking") fixed the locking for the asynchronous smp-call case, but in the process of moving the lock handling around, one of the error cases ended up not unlocking the call data at all. This went unnoticed on x86, because this is a "caller is buggy" case, where the caller is trying to call a non-existent CPU. But apparently ARM does that (at least under qemu-arm). Bindly doing cross-cpu calls to random CPU's that aren't even online seems a bit fishy, but the error handling was clearly not correct. Simply add the missing "csd_unlock()" to the error path. Reported-and-tested-by: Guenter Roeck Analyzed-by: Rabin Vincent Acked-by: Ingo Molnar Signed-off-by: Linus Torvalds --- kernel/smp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/smp.c b/kernel/smp.c index 2aaac2c47683d..07854477c1644 100644 --- a/kernel/smp.c +++ b/kernel/smp.c @@ -159,8 +159,10 @@ static int generic_exec_single(int cpu, struct call_single_data *csd, } - if ((unsigned)cpu >= nr_cpu_ids || !cpu_online(cpu)) + if ((unsigned)cpu >= nr_cpu_ids || !cpu_online(cpu)) { + csd_unlock(csd); return -ENXIO; + } csd->func = func; csd->info = info; -- 2.39.5