linux-kernel - Re: ARM: imx: mmdc: Fix completely broken cpu hotplug code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1612211928430.3424@nanos>
Date:   Wed, 21 Dec 2016 19:32:06 +0100 (CET)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     LKML <linux-kernel@...r.kernel.org>
cc:     LAK <linux-arm-kernel@...ts.infradead.org>,
        Zhengyu Shen <zhengyu.shen@....com>,
        Frank Li <frank.li@....com>, Shawn Guo <shawnguo@...nel.org>,
        Sebastian Sewior <bigeasy@...utronix.de>
Subject: Re: ARM: imx: mmdc: Fix completely broken cpu hotplug code

On Wed, 21 Dec 2016, Thomas Gleixner wrote:
> The cpu hotplug support of this perf driver is broken in several ways:
> 
> 1) It adds a instance before setting up the state.
> 
> 2) The state for the instance is different from the state of the
>    callback. It's just a randomly chosen state.
> 
> 3) The instance registration is not error checked so nobody noticed that
>    the call can never succeed.
> 
> 4) The state for the multi install callbacks is chosen randomly and
>    overwrites existing state. This is now prevented by the core code so the
>    call is guaranteed to fail.
> 
> 5) The error exit path in the init function leaves the instance registered
>    and then frees the memory which contains the enqueued hlist node.
> 
> 6) The remove function is removing the state and not the instance.
> 
> Fix it by:
> 
> - Setting up the state before adding instances. Use a dynamically allocated
>   state for it.
> 
> - Install instances after the state has been set up
> 
> - Remove the instance in the error path before freeing memory
> 
> - Remove instance not the state in the driver remove callback
> 
> While at is use raw_cpu_processor_id(), because cpu_processor_id() cannot
> be used in preemptible context, and set the driver data after successful
> registration of the pmu.
> 
> Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver")
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> Cc: Zhengyu Shen <zhengyu.shen@....com>
> Cc: Frank Li <frank.li@....com>
> Cc: Shawn Guo <shawnguo@...nel.org>

Shawn,

as I have the final hotplug notifier removal pending here, which will break
also the compilation of this driver, I would prefer to merge that through
my tree before the removal patches to avoid build breakage.

Thanks,

	tglx