Patch "cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble" has been added to the 4.6-stable tree

Patch "cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble" has been added to the 4.6-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble

to the 4.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     cpu-hotplug-keep-enough-storage-space-if-smp-n-to-avoid-array-out-of-bounds-scribble.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From a7c734140aa36413944eef0f8c660e0e2256357d Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 12 Jul 2016 21:59:23 +0200
Subject: cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble

From: Thomas Gleixner <tglx@linutronix.de>

commit a7c734140aa36413944eef0f8c660e0e2256357d upstream.

Xiaolong Ye reported lock debug warnings triggered by the following commit:

  8de4a0066106 ("perf/x86: Convert the core to the hotplug state machine")

The bug is the following: the cpuhp_bp_states[] array is cut short when
CONFIG_SMP=n, but the dynamically registered callbacks are stored nevertheless
and happily scribble outside of the array bounds...

We need to store them in case that the state is unregistered so we can invoke
the teardown function. That's independent of CONFIG_SMP. Make sure the array
is large enough.

Reported-by: kernel test robot <xiaolong.ye@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Borowski <kilobyte@angband.pl>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anna-Maria Gleixner <anna-maria@linutronix.de>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Stephane Eranian <eranian@google.com>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: lkp@01.org
Cc: tipbuild@zytor.com
Fixes: cff7d378d3fd "cpu/hotplug: Convert to a state machine for the control processor"
Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1607122144560.4083@nanos
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/cpu.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1218,6 +1218,8 @@ static struct cpuhp_step cpuhp_bp_states
 		.teardown		= takedown_cpu,
 		.cant_stop		= true,
 	},
+#else
+	[CPUHP_BRINGUP_CPU] = { },
 #endif
 };
 


Patches currently in stable-queue which might be from tglx@linutronix.de are

queue-4.6/cpu-hotplug-keep-enough-storage-space-if-smp-n-to-avoid-array-out-of-bounds-scribble.patch
queue-4.6/x86-quirks-apply-nvidia_bugs-quirk-only-on-root-bus.patch
queue-4.6/irqchip-mips-gic-match-ipi-irq-domain-by-bus-token-only.patch
queue-4.6/x86-quirks-add-early-quirk-to-reset-apple-airport-card.patch
queue-4.6/sched-fair-fix-effective_load-to-consistently-use-smoothed-load.patch
queue-4.6/sched-debug-fix-deadlock-when-enabling-sched-events.patch
queue-4.6/x86-quirks-reintroduce-scanning-of-secondary-buses.patch
queue-4.6/irqchip-mips-gic-map-to-vps-using-hw-vpnum.patch
queue-4.6/kernel-sysrq-watchdog-sched-core-reset-watchdog-on-all-cpus-while-processing-sysrq-w.patch
queue-4.6/posix_cpu_timer-exit-early-when-process-has-been-reaped.patch