Commit 802bf931 authored by Mike Travis's avatar Mike Travis Committed by Ingo Molnar
Browse files

cpumask: fix bug in use cpumask_var_t in irq_desc 



Impact: fix bug where new irq_desc uses old cpumask pointers which are freed.

As Yinghai pointed out, init_copy_one_irq_desc() copies the old desc to
the new desc overwriting the cpumask pointers.  Since the old_desc and
the cpumask pointers are freed, then memory corruption will occur if
these old pointers are used.

Move the allocation of these pointers to after the copy.

Signed-off-by: default avatarMike Travis <travis@sgi.com>
Cc: Yinghai Lu <yinghai@kernel.org>
parent 651f8118

include/linux/irq.h

+7 −2
Original line number Original line Diff line number Diff line
@@ -426,15 +426,18 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry); 
/**

/**

 * init_alloc_desc_masks - allocate cpumasks for irq_desc

 * init_alloc_desc_masks - allocate cpumasks for irq_desc

 * @desc:	pointer to irq_desc struct

 * @desc:	pointer to irq_desc struct

 * @cpu:	cpu which will be handling the cpumasks

 * @boot:	true if need bootmem

 * @boot:	true if need bootmem

 *

 *

 * Allocates affinity and pending_mask cpumask if required.

 * Allocates affinity and pending_mask cpumask if required.

 * Returns true if successful (or not required).

 * Returns true if successful (or not required).

 * Side effect: affinity has all bits set, pending_mask has all bits clear.

 * Side effect: affinity has all bits set, pending_mask has all bits clear.

 */

 */

static inline bool init_alloc_desc_masks(struct irq_desc *desc, int node,

static inline bool init_alloc_desc_masks(struct irq_desc *desc, int cpu,

								bool boot)

								bool boot)

{

{

	int node;



	if (boot) {

	if (boot) {

		alloc_bootmem_cpumask_var(&desc->affinity);

		alloc_bootmem_cpumask_var(&desc->affinity);

		cpumask_setall(desc->affinity);

		cpumask_setall(desc->affinity);
@@ -446,6 +449,8 @@ static inline bool init_alloc_desc_masks(struct irq_desc *desc, int node, 
		return true;

		return true;

	}

	}





	node = cpu_to_node(cpu);



	if (!alloc_cpumask_var_node(&desc->affinity, GFP_ATOMIC, node))

	if (!alloc_cpumask_var_node(&desc->affinity, GFP_ATOMIC, node))

		return false;

		return false;

	cpumask_setall(desc->affinity);

	cpumask_setall(desc->affinity);
@@ -484,7 +489,7 @@ static inline void init_copy_desc_masks(struct irq_desc *old_desc, 




#else /* !CONFIG_SMP */

#else /* !CONFIG_SMP */





static inline bool init_alloc_desc_masks(struct irq_desc *desc, int node,

static inline bool init_alloc_desc_masks(struct irq_desc *desc, int cpu,

								bool boot)

								bool boot)

{

{

	return true;

	return true;

kernel/irq/handle.c

+1 −7
Original line number Original line Diff line number Diff line
@@ -85,8 +85,6 @@ void init_kstat_irqs(struct irq_desc *desc, int cpu, int nr) 




static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu)

static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu)

{

{

	int node = cpu_to_node(cpu);



	memcpy(desc, &irq_desc_init, sizeof(struct irq_desc));

	memcpy(desc, &irq_desc_init, sizeof(struct irq_desc));





	spin_lock_init(&desc->lock);

	spin_lock_init(&desc->lock);
@@ -100,7 +98,7 @@ static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu) 
		printk(KERN_ERR "can not alloc kstat_irqs\n");

		printk(KERN_ERR "can not alloc kstat_irqs\n");

		BUG_ON(1);

		BUG_ON(1);

	}

	}

	if (!init_alloc_desc_masks(desc, node, false)) {

	if (!init_alloc_desc_masks(desc, cpu, false)) {

		printk(KERN_ERR "can not alloc irq_desc cpumasks\n");

		printk(KERN_ERR "can not alloc irq_desc cpumasks\n");

		BUG_ON(1);

		BUG_ON(1);

	}

	}
@@ -188,10 +186,6 @@ struct irq_desc *irq_to_desc_alloc_cpu(unsigned int irq, int cpu) 
		printk(KERN_ERR "can not alloc irq_desc\n");

		printk(KERN_ERR "can not alloc irq_desc\n");

		BUG_ON(1);

		BUG_ON(1);

	}

	}

	if (!init_alloc_desc_masks(desc, node, false)) {

		printk(KERN_ERR "can not alloc irq_desc cpumasks\n");

		BUG_ON(1);

	}

	init_one_irq_desc(irq, desc, cpu);

	init_one_irq_desc(irq, desc, cpu);





	irq_desc_ptrs[irq] = desc;

	irq_desc_ptrs[irq] = desc;

kernel/irq/numa_migrate.c

+8 −5
Original line number Original line Diff line number Diff line
@@ -38,16 +38,22 @@ static void free_kstat_irqs(struct irq_desc *old_desc, struct irq_desc *desc) 
	old_desc->kstat_irqs = NULL;

	old_desc->kstat_irqs = NULL;

}

}





static void init_copy_one_irq_desc(int irq, struct irq_desc *old_desc,

static bool init_copy_one_irq_desc(int irq, struct irq_desc *old_desc,

		 struct irq_desc *desc, int cpu)

		 struct irq_desc *desc, int cpu)

{

{

	memcpy(desc, old_desc, sizeof(struct irq_desc));

	memcpy(desc, old_desc, sizeof(struct irq_desc));

	if (!init_alloc_desc_masks(desc, cpu, false)) {

		printk(KERN_ERR "irq %d: can not get new irq_desc cpumask "

				"for migration.\n", irq);

		return false;

	}

	spin_lock_init(&desc->lock);

	spin_lock_init(&desc->lock);

	desc->cpu = cpu;

	desc->cpu = cpu;

	lockdep_set_class(&desc->lock, &irq_desc_lock_class);

	lockdep_set_class(&desc->lock, &irq_desc_lock_class);

	init_copy_kstat_irqs(old_desc, desc, cpu, nr_cpu_ids);

	init_copy_kstat_irqs(old_desc, desc, cpu, nr_cpu_ids);

	init_copy_desc_masks(old_desc, desc);

	init_copy_desc_masks(old_desc, desc);

	arch_init_copy_chip_data(old_desc, desc, cpu);

	arch_init_copy_chip_data(old_desc, desc, cpu);

	return true;

}

}





static void free_one_irq_desc(struct irq_desc *old_desc, struct irq_desc *desc)

static void free_one_irq_desc(struct irq_desc *old_desc, struct irq_desc *desc)
@@ -83,15 +89,12 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc, 
		desc = old_desc;

		desc = old_desc;

		goto out_unlock;

		goto out_unlock;

	}

	}

	if (!init_alloc_desc_masks(desc, node, false)) {

	if (!init_copy_one_irq_desc(irq, old_desc, desc, cpu)) {

		printk(KERN_ERR "irq %d: can not get new irq_desc cpumask "

				"for migration.\n", irq);

		/* still use old one */

		/* still use old one */

		kfree(desc);

		kfree(desc);

		desc = old_desc;

		desc = old_desc;

		goto out_unlock;

		goto out_unlock;

	}

	}

	init_copy_one_irq_desc(irq, old_desc, desc, cpu);





	irq_desc_ptrs[irq] = desc;

	irq_desc_ptrs[irq] = desc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE