Re: [PATCH V2] kernel/smp.c: fix a panic as cp->info is used wrongly and a, list corruption

[Jiri Slaby <jslaby@suse.cz>]

On 05/15/2015, 11:04 AM, Pan Xinhui wrote:
> this patch reverts commit 3440a1 which causes the regression and fix a
> list corruption.
> 
> base knowledge: kernel call cp->func using cp->info as its argument.
> like cp->func(cp->info);
> 
> current code is totally wrong, as 1) &softirq is at stack. 2) cp->info
> don't point to struct call_single_data.
> So in remote_softirq_receive,
> 1) If the caller had left __try_remote_softirq, dereferencing cp->info
> could not fetch the correct value.
> 2) And we can't get struct call_single_data *cp anymore.
> 
> The list corruption is below.
> __local_trigger will add cp->list into softirq_work_list. But no one
> will delete cp->list on behalf of us.
> if we can succeed to raise_softirq_irqoff, we must delete it from
> softirq_work_list. because we will lost control of pointer cp.
> cp is passed in and may be freed later in other places.
> 
> Signed-off-by: Pan Xinhui <xinhuix.pan@intel.com>
> ---
> Changes in v2:
>  no codes changed from v1, just update the comment.
>  upstream commit fc21c0 fix this issue, as it removes the total feature. :)
>  the buggy codes exist in v3.10 and v3.12.

Applied fc21c0cff2f425891b28ff6fb6b03b325c977428 to 3.12. Thanks.

-- 
js
suse labs