diff options
| author | Zqiang <qiang.zhang1211@gmail.com> | 2026-03-04 10:57:24 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-03-25 11:06:01 +0100 |
| commit | 3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9 (patch) | |
| tree | b640ce920bf874055be89ee541a7e0634b0367a3 /kernel | |
| parent | 8af210df4f71dda74dc027da69372a028c6d4d84 (diff) | |
| download | linux-3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9.tar.gz linux-3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9.tar.bz2 linux-3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9.zip | |
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
[ Upstream commit 1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1 ]
In the preparation stage of CPU online, if the corresponding
the rdp's->nocb_cb_kthread does not exist, will be created,
there is a situation where the rdp's rcuop kthreads creation fails,
and then de-offload this CPU's rdp, does not assign this CPU's
rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and
rdp's->rdp_gp->nocb_gp_kthread is still valid.
This will cause the subsequent re-offload operation of this offline
CPU, which will pass the conditional check and the kthread_unpark()
will access invalid rdp's->nocb_cb_kthread pointer.
This commit therefore use rdp's->nocb_gp_kthread instead of
rdp_gp's->nocb_gp_kthread for safety check.
Signed-off-by: Zqiang <qiang.zhang1211@gmail.com>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay@kernel.org>
[ Minor conflict resolved. ]
Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/rcu/tree_nocb.h | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/kernel/rcu/tree_nocb.h b/kernel/rcu/tree_nocb.h index 8993b2322be2..a3d613f063a8 100644 --- a/kernel/rcu/tree_nocb.h +++ b/kernel/rcu/tree_nocb.h @@ -1221,7 +1221,6 @@ static long rcu_nocb_rdp_offload(void *arg) struct rcu_segcblist *cblist = &rdp->cblist; unsigned long flags; int wake_gp; - struct rcu_data *rdp_gp = rdp->nocb_gp_rdp; WARN_ON_ONCE(rdp->cpu != raw_smp_processor_id()); /* @@ -1231,7 +1230,7 @@ static long rcu_nocb_rdp_offload(void *arg) if (!rdp->nocb_gp_rdp) return -EINVAL; - if (WARN_ON_ONCE(!rdp_gp->nocb_gp_kthread)) + if (WARN_ON_ONCE(!rdp->nocb_gp_kthread)) return -EINVAL; pr_info("Offloading %d\n", rdp->cpu); @@ -1260,7 +1259,7 @@ static long rcu_nocb_rdp_offload(void *arg) */ wake_gp = rdp_offload_toggle(rdp, true, flags); if (wake_gp) - wake_up_process(rdp_gp->nocb_gp_kthread); + wake_up_process(rdp->nocb_gp_kthread); swait_event_exclusive(rdp->nocb_state_wq, rcu_segcblist_test_flags(cblist, SEGCBLIST_KTHREAD_CB) && rcu_segcblist_test_flags(cblist, SEGCBLIST_KTHREAD_GP)); |