Re: [PATCH] s390/cpum_cf: Handle CPU hotplug add and delete

[Heiko Carstens <hca@linux.ibm.com>]

> > [Severity: High]
> > This is a pre-existing issue, but is it possible for an interrupt to
> > dereference this pointer after it is freed?
> > 
> > Since cpum_cf_free_cpu() executes with interrupts enabled, if a CPUMF
> > measurement alert interrupt triggers right after kfree(cpuhw) but before
> > p->cpucf is set to NULL:
> > 
> > cpum_cf_free_cpu()
> >   kfree(cpuhw);
> >   
> >   --- interrupt occurs ---
> >   cpumf_measurement_alert()
> >     this_cpu_cfhw() -> returns p->cpucf
> >     ... accesses freed memory ...
> > 
> > Would it be safer to clear the pointer before calling kfree?
> 
> The interrupt handler is shared an protects against a NULL ptr:
>         /*                                                                    
>          * Measurement alerts are shared and might happen when the PMU        
>          * is not reserved.  Ignore these alerts in this case.                
>          */                                                                   
>         cpuhw = this_cpu_cfhw();                                              
>         if (!cpuhw)                                                           
>                 return;

This is not the problem outlined above. In the described scenario
kfree(cpuhw) is done, then an interrupt happens, and the interrupt
handler sees and potentially uses the already freed memory, since
this_cpu_cfhw() does _not_ return NULL.
Problem is that data is freed before the pointer is set to NULL.