Commit 802bf931 authored by Mike Travis's avatar Mike Travis Committed by Ingo Molnar

cpumask: fix bug in use cpumask_var_t in irq_desc

Impact: fix bug where new irq_desc uses old cpumask pointers which are freed.

As Yinghai pointed out, init_copy_one_irq_desc() copies the old desc to
the new desc overwriting the cpumask pointers.  Since the old_desc and
the cpumask pointers are freed, then memory corruption will occur if
these old pointers are used.

Move the allocation of these pointers to after the copy.
Signed-off-by: default avatarMike Travis <travis@sgi.com>
Cc: Yinghai Lu <yinghai@kernel.org>
parent 651f8118
...@@ -426,15 +426,18 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry); ...@@ -426,15 +426,18 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry);
/** /**
* init_alloc_desc_masks - allocate cpumasks for irq_desc * init_alloc_desc_masks - allocate cpumasks for irq_desc
* @desc: pointer to irq_desc struct * @desc: pointer to irq_desc struct
* @cpu: cpu which will be handling the cpumasks
* @boot: true if need bootmem * @boot: true if need bootmem
* *
* Allocates affinity and pending_mask cpumask if required. * Allocates affinity and pending_mask cpumask if required.
* Returns true if successful (or not required). * Returns true if successful (or not required).
* Side effect: affinity has all bits set, pending_mask has all bits clear. * Side effect: affinity has all bits set, pending_mask has all bits clear.
*/ */
static inline bool init_alloc_desc_masks(struct irq_desc *desc, int node, static inline bool init_alloc_desc_masks(struct irq_desc *desc, int cpu,
bool boot) bool boot)
{ {
int node;
if (boot) { if (boot) {
alloc_bootmem_cpumask_var(&desc->affinity); alloc_bootmem_cpumask_var(&desc->affinity);
cpumask_setall(desc->affinity); cpumask_setall(desc->affinity);
...@@ -446,6 +449,8 @@ static inline bool init_alloc_desc_masks(struct irq_desc *desc, int node, ...@@ -446,6 +449,8 @@ static inline bool init_alloc_desc_masks(struct irq_desc *desc, int node,
return true; return true;
} }
node = cpu_to_node(cpu);
if (!alloc_cpumask_var_node(&desc->affinity, GFP_ATOMIC, node)) if (!alloc_cpumask_var_node(&desc->affinity, GFP_ATOMIC, node))
return false; return false;
cpumask_setall(desc->affinity); cpumask_setall(desc->affinity);
...@@ -484,7 +489,7 @@ static inline void init_copy_desc_masks(struct irq_desc *old_desc, ...@@ -484,7 +489,7 @@ static inline void init_copy_desc_masks(struct irq_desc *old_desc,
#else /* !CONFIG_SMP */ #else /* !CONFIG_SMP */
static inline bool init_alloc_desc_masks(struct irq_desc *desc, int node, static inline bool init_alloc_desc_masks(struct irq_desc *desc, int cpu,
bool boot) bool boot)
{ {
return true; return true;
......
...@@ -85,8 +85,6 @@ void init_kstat_irqs(struct irq_desc *desc, int cpu, int nr) ...@@ -85,8 +85,6 @@ void init_kstat_irqs(struct irq_desc *desc, int cpu, int nr)
static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu) static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu)
{ {
int node = cpu_to_node(cpu);
memcpy(desc, &irq_desc_init, sizeof(struct irq_desc)); memcpy(desc, &irq_desc_init, sizeof(struct irq_desc));
spin_lock_init(&desc->lock); spin_lock_init(&desc->lock);
...@@ -100,7 +98,7 @@ static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu) ...@@ -100,7 +98,7 @@ static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu)
printk(KERN_ERR "can not alloc kstat_irqs\n"); printk(KERN_ERR "can not alloc kstat_irqs\n");
BUG_ON(1); BUG_ON(1);
} }
if (!init_alloc_desc_masks(desc, node, false)) { if (!init_alloc_desc_masks(desc, cpu, false)) {
printk(KERN_ERR "can not alloc irq_desc cpumasks\n"); printk(KERN_ERR "can not alloc irq_desc cpumasks\n");
BUG_ON(1); BUG_ON(1);
} }
...@@ -188,10 +186,6 @@ struct irq_desc *irq_to_desc_alloc_cpu(unsigned int irq, int cpu) ...@@ -188,10 +186,6 @@ struct irq_desc *irq_to_desc_alloc_cpu(unsigned int irq, int cpu)
printk(KERN_ERR "can not alloc irq_desc\n"); printk(KERN_ERR "can not alloc irq_desc\n");
BUG_ON(1); BUG_ON(1);
} }
if (!init_alloc_desc_masks(desc, node, false)) {
printk(KERN_ERR "can not alloc irq_desc cpumasks\n");
BUG_ON(1);
}
init_one_irq_desc(irq, desc, cpu); init_one_irq_desc(irq, desc, cpu);
irq_desc_ptrs[irq] = desc; irq_desc_ptrs[irq] = desc;
......
...@@ -38,16 +38,22 @@ static void free_kstat_irqs(struct irq_desc *old_desc, struct irq_desc *desc) ...@@ -38,16 +38,22 @@ static void free_kstat_irqs(struct irq_desc *old_desc, struct irq_desc *desc)
old_desc->kstat_irqs = NULL; old_desc->kstat_irqs = NULL;
} }
static void init_copy_one_irq_desc(int irq, struct irq_desc *old_desc, static bool init_copy_one_irq_desc(int irq, struct irq_desc *old_desc,
struct irq_desc *desc, int cpu) struct irq_desc *desc, int cpu)
{ {
memcpy(desc, old_desc, sizeof(struct irq_desc)); memcpy(desc, old_desc, sizeof(struct irq_desc));
if (!init_alloc_desc_masks(desc, cpu, false)) {
printk(KERN_ERR "irq %d: can not get new irq_desc cpumask "
"for migration.\n", irq);
return false;
}
spin_lock_init(&desc->lock); spin_lock_init(&desc->lock);
desc->cpu = cpu; desc->cpu = cpu;
lockdep_set_class(&desc->lock, &irq_desc_lock_class); lockdep_set_class(&desc->lock, &irq_desc_lock_class);
init_copy_kstat_irqs(old_desc, desc, cpu, nr_cpu_ids); init_copy_kstat_irqs(old_desc, desc, cpu, nr_cpu_ids);
init_copy_desc_masks(old_desc, desc); init_copy_desc_masks(old_desc, desc);
arch_init_copy_chip_data(old_desc, desc, cpu); arch_init_copy_chip_data(old_desc, desc, cpu);
return true;
} }
static void free_one_irq_desc(struct irq_desc *old_desc, struct irq_desc *desc) static void free_one_irq_desc(struct irq_desc *old_desc, struct irq_desc *desc)
...@@ -83,15 +89,12 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc, ...@@ -83,15 +89,12 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc,
desc = old_desc; desc = old_desc;
goto out_unlock; goto out_unlock;
} }
if (!init_alloc_desc_masks(desc, node, false)) { if (!init_copy_one_irq_desc(irq, old_desc, desc, cpu)) {
printk(KERN_ERR "irq %d: can not get new irq_desc cpumask "
"for migration.\n", irq);
/* still use old one */ /* still use old one */
kfree(desc); kfree(desc);
desc = old_desc; desc = old_desc;
goto out_unlock; goto out_unlock;
} }
init_copy_one_irq_desc(irq, old_desc, desc, cpu);
irq_desc_ptrs[irq] = desc; irq_desc_ptrs[irq] = desc;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment