Commit fe38d855 authored by Chuck Ebbert's avatar Chuck Ebbert Committed by Linus Torvalds
Browse files

[PATCH] i386 cpu hotplug: don't access freed memory 



i386 CPU init code accesses freed init memory when booting a newly-started
processor after CPU hotplug.  The cpu_devs array is searched to find the
vendor and it contains pointers to freed data.

Fix that by:

        1. Zeroing entries for freed vendor data after bootup.
        2. Changing Transmeta, NSC and UMC to all __init[data].
        3. Printing a warning (once only) and setting this_cpu
           to a safe default when the vendor is not found.

This does not change behavior for AMD systems.  They were broken already
but no error was reported.

Signed-off-by: default avatarChuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 170aa3d0

arch/i386/kernel/cpu/amd.c

+8 −0
Original line number Diff line number Diff line
@@ -282,3 +282,11 @@ int __init amd_init_cpu(void) 
}



//early_arch_initcall(amd_init_cpu);



static int __init amd_exit_cpu(void)

{

	cpu_devs[X86_VENDOR_AMD] = NULL;

	return 0;

}



late_initcall(amd_exit_cpu);

arch/i386/kernel/cpu/centaur.c

+8 −0
Original line number Diff line number Diff line
@@ -470,3 +470,11 @@ int __init centaur_init_cpu(void) 
}



//early_arch_initcall(centaur_init_cpu);



static int __init centaur_exit_cpu(void)

{

	cpu_devs[X86_VENDOR_CENTAUR] = NULL;

	return 0;

}



late_initcall(centaur_exit_cpu);

arch/i386/kernel/cpu/common.c

+10 −1
Original line number Diff line number Diff line
@@ -44,6 +44,7 @@ static void default_init(struct cpuinfo_x86 * c) 


static struct cpu_dev default_cpu = {

	.c_init	= default_init,

	.c_vendor = "Unknown",

};

static struct cpu_dev * this_cpu = &default_cpu;
@@ -150,6 +151,7 @@ static void __devinit get_cpu_vendor(struct cpuinfo_x86 *c, int early) 
{

	char *v = c->x86_vendor_id;

	int i;

	static int printed;



	for (i = 0; i < X86_VENDOR_NUM; i++) {

		if (cpu_devs[i]) {
@@ -159,10 +161,17 @@ static void __devinit get_cpu_vendor(struct cpuinfo_x86 *c, int early) 
				c->x86_vendor = i;

				if (!early)

					this_cpu = cpu_devs[i];

				break;

				return;

			}

		}

	}

	if (!printed) {

		printed++;

		printk(KERN_ERR "CPU: Vendor unknown, using generic init.\n");

		printk(KERN_ERR "CPU: Your system may be unstable.\n");

	}

	c->x86_vendor = X86_VENDOR_UNKNOWN;

	this_cpu = &default_cpu;

}

arch/i386/kernel/cpu/cyrix.c

+17 −1
Original line number Diff line number Diff line
@@ -345,7 +345,7 @@ static void __init init_cyrix(struct cpuinfo_x86 *c) 
/*

 * Handle National Semiconductor branded processors

 */

static void __devinit init_nsc(struct cpuinfo_x86 *c)

static void __init init_nsc(struct cpuinfo_x86 *c)

{

	/* There may be GX1 processors in the wild that are branded

	 * NSC and not Cyrix.
@@ -444,6 +444,14 @@ int __init cyrix_init_cpu(void) 


//early_arch_initcall(cyrix_init_cpu);



static int __init cyrix_exit_cpu(void)

{

	cpu_devs[X86_VENDOR_CYRIX] = NULL;

	return 0;

}



late_initcall(cyrix_exit_cpu);



static struct cpu_dev nsc_cpu_dev __initdata = {

	.c_vendor	= "NSC",

	.c_ident 	= { "Geode by NSC" },
@@ -458,3 +466,11 @@ int __init nsc_init_cpu(void) 
}



//early_arch_initcall(nsc_init_cpu);



static int __init nsc_exit_cpu(void)

{

	cpu_devs[X86_VENDOR_NSC] = NULL;

	return 0;

}



late_initcall(nsc_exit_cpu);

arch/i386/kernel/cpu/intel_cacheinfo.c

+1 −0
Original line number Diff line number Diff line
@@ -152,6 +152,7 @@ static int __cpuinit cpuid4_cache_lookup(int index, struct _cpuid4_info *this_le 
	return 0;

}



/* will only be called once; __init is safe here */

static int __init find_num_cache_leaves(void)

{

	unsigned int		eax, ebx, ecx, edx;

CRA Git | Maintained and supported by SUSTech CRA and CCSE