diff options
author | Daniel Jordan <daniel.m.jordan@oracle.com> | 2020-04-21 12:34:55 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-08-08 08:54:30 +0200 |
commit | 93175d935d76f4a7220fe9111ba452bb5c512fa4 (patch) | |
tree | 8a8d6ed7e6d608346ca613635e88e5ebedfae052 /include/linux | |
parent | 2b1207801c393a5e9af2fbac2dd8b0377d8ae63a (diff) | |
download | linux-stable-93175d935d76f4a7220fe9111ba452bb5c512fa4.tar.gz linux-stable-93175d935d76f4a7220fe9111ba452bb5c512fa4.tar.bz2 linux-stable-93175d935d76f4a7220fe9111ba452bb5c512fa4.zip |
padata: add separate cpuhp node for CPUHP_PADATA_DEAD
commit 3c2214b6027ff37945799de717c417212e1a8c54 upstream.
Removing the pcrypt module triggers this:
general protection fault, probably for non-canonical
address 0xdead000000000122
CPU: 5 PID: 264 Comm: modprobe Not tainted 5.6.0+ #2
Hardware name: QEMU Standard PC
RIP: 0010:__cpuhp_state_remove_instance+0xcc/0x120
Call Trace:
padata_sysfs_release+0x74/0xce
kobject_put+0x81/0xd0
padata_free+0x12/0x20
pcrypt_exit+0x43/0x8ee [pcrypt]
padata instances wrongly use the same hlist node for the online and dead
states, so __padata_free()'s second cpuhp remove call chokes on the node
that the first poisoned.
cpuhp multi-instance callbacks only walk forward in cpuhp_step->list and
the same node is linked in both the online and dead lists, so the list
corruption that results from padata_alloc() adding the node to a second
list without removing it from the first doesn't cause problems as long
as no instances are freed.
Avoid the issue by giving each state its own node.
Fixes: 894c9ef9780c ("padata: validate cpumask without removed CPU during offline")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux')
-rw-r--r-- | include/linux/padata.h | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/include/linux/padata.h b/include/linux/padata.h index d803397a28f7..8c9827cc6374 100644 --- a/include/linux/padata.h +++ b/include/linux/padata.h @@ -138,7 +138,8 @@ struct parallel_data { /** * struct padata_instance - The overall control structure. * - * @cpu_notifier: cpu hotplug notifier. + * @cpu_online_node: Linkage for CPU online callback. + * @cpu_dead_node: Linkage for CPU offline callback. * @wq: The workqueue in use. * @pd: The internal control structure. * @cpumask: User supplied cpumasks for parallel and serial works. @@ -150,7 +151,8 @@ struct parallel_data { * @flags: padata flags. */ struct padata_instance { - struct hlist_node node; + struct hlist_node cpu_online_node; + struct hlist_node cpu_dead_node; struct workqueue_struct *wq; struct parallel_data *pd; struct padata_cpumask cpumask; |