From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753823AbbF0J4f (ORCPT ); Sat, 27 Jun 2015 05:56:35 -0400 Received: from mout.web.de ([212.227.15.3]:57919 "EHLO mout.web.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752915AbbF0J41 (ORCPT ); Sat, 27 Jun 2015 05:56:27 -0400 Message-ID: <558E7325.70505@web.de> Date: Sat, 27 Jun 2015 11:55:49 +0200 From: Jan Kiszka User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.8.1.12) Gecko/20080226 SUSE/2.0.0.12-1.1 Thunderbird/2.0.0.12 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: Thomas Gleixner , LKML CC: Ingo Molnar , Peter Zijlstra , Paul McKenney , Frederic Weisbecker , Eric Dumazet , Viresh Kumar , John Stultz , Joonwoo Park , Wenbo Wang , Steven Rostedt , Badhri Jagan Sridharan Subject: [PATCH] timer: Fix unsafe cpu variable access in migrate_timers References: <20150526210723.245729529@linutronix.de> <20150526224511.950084301@linutronix.de> In-Reply-To: <20150526224511.950084301@linutronix.de> Content-Type: text/plain; charset=iso-8859-15 Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:JT7vS7f54e2KmFErVQp57uAikJXmXcwL+nwnsYuQjm50ZNGR2In b3MfBbQqd+DEhu1Fw6K7sWW2qRWXm8ZJjsokH5M7Z5+8Sqal9UcMkQ7eQAKyc1S1KkWp2P4 M2EIJzf78qvDRWgapW/6+8pzFxjaIAV9IrcPEXegpJv71W+s8aR3fsftSeS99pxYJAqdszU X9y/1EbQEYf0Q3ThqREcQ== X-UI-Out-Filterresults: notjunk:1;V01:K0:9eCy0AshA3A=:6C1L86ZhW6SNTDZNHcPb0f T0zug2N+xAdtSedeuTLIZPizIH0oNsuze9FV5sP+jRyvFrePqF0wVa/T8O1Nt/D+vUDLNuuLn NIrtT5FCAa6o0emYh+2vQeml+j03PZp4cESkTaRJfKycz719eI34sumzB7iaTiqLAqN7aXYw3 Z8MHCFFoI9JwUsBuGLCyV9UjGjJjQBC3k5Ght7eF7wHBxCZTaJxNxigW9Lll64Ek8JrAbfu7Z 5q2cexaFY97xQiX5fRMErBjXvOb3LwLoB+98zsGlnfYHYKFkIz/x6Sxel31CrXfE3kJyfpjxq Mrgatkjk12MW4m04RWDp5315MbSwsT/j7gmtCzz8t4WXg7S54oMJ4Ha0LD4pCq57rm+L12ub6 /K6HYGhPmERUvFwzVW9ADJmhl5OU3sybwrjgO5FEeBIkmnMw5QdPmYMMq5yurPKd2oyF6nOpB PB3WNcm3SDqJkwUsPxgOGo29/gX3fyBQXMQLjWY37ANfNhHsEgmO1+3cpkJqN9CoXpHifx222 Z8WiLPXZlrylAD8+MNKchNlk4MIIx+b+9WGR7GOe5pdFP45g9MUDWFDWEtWtkKeDNVSf/5KN+ ylmFf+ZCPGybmBGk/biib9OXw56DTtIO89Sq94C4BiIR9PDoF3b8AYWu7iNFoxkVQszv7gN1I 69hnJchzUFm7F3FjbviNppmttw0MTLYIB1hNwb6HUumreUKYJpKCDzyHHkwM2wYh4Avk= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jan Kiszka migrate_timers is invoked with preemption enabled. Therefore we have to get/put the cpu-local variable tvec_bases like before commit 0eeda71bc3. This fixes BUG: using smp_processor_id() in preemptible [00000000] code: bash/4917 caller is debug_smp_processor_id+0x17/0x19 CPU: 0 PID: 4917 Comm: bash Not tainted 4.1.0-dbg+ #97 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014 ffff880038674040 ffff880002e6fb98 ffffffff815356a0 0000000000000002 0000000000000000 ffff880002e6fbc8 ffffffff8130c16f ffff88003fd8d500 000000000000d500 0000000000000000 0000000000000003 ffff880002e6fbd8 Call Trace: [] dump_stack+0x4f/0x7b [] check_preemption_disabled+0xdd/0xef [] debug_smp_processor_id+0x17/0x19 [] timer_cpu_notify+0x4f/0x112 [] notifier_call_chain+0x4c/0x71 [] __raw_notifier_call_chain+0xe/0x10 [] __cpu_notify+0x20/0x37 [] cpu_notify+0x13/0x15 [] cpu_notify_nofail+0xe/0x16 [] _cpu_down+0x178/0x268 [] ? trace_hardirqs_on+0xd/0xf [] cpu_down+0x28/0x3c [] cpu_subsys_offline+0x14/0x16 [] device_offline+0x7d/0xb1 [] online_store+0x48/0x68 [] dev_attr_store+0x18/0x22 [] sysfs_kf_write+0x49/0x51 [] kernfs_fop_write+0x105/0x158 [] __vfs_write+0x28/0xbd [] ? security_file_permission+0x23/0x90 [] vfs_write+0xb2/0x169 [] SyS_write+0x4a/0x91 [] entry_SYSCALL_64_fastpath+0x12/0x76 triggered when offlining a CPU, e.g. via sysfs. Signed-off-by: Jan Kiszka --- kernel/time/timer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/time/timer.c b/kernel/time/timer.c index 520499d..c826178 100644 --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -1566,7 +1566,7 @@ static void migrate_timers(int cpu) BUG_ON(cpu_online(cpu)); old_base = per_cpu_ptr(&tvec_bases, cpu); - new_base = this_cpu_ptr(&tvec_bases); + new_base = &get_cpu_var(tvec_bases); /* * The caller is globally serialized and nobody else * takes two locks at once, deadlock is not possible. @@ -1590,6 +1590,7 @@ static void migrate_timers(int cpu) spin_unlock(&old_base->lock); spin_unlock_irq(&new_base->lock); + put_cpu_var(tvec_bases); } static int timer_cpu_notify(struct notifier_block *self,