[PATCH v2 1/3] powerpc/xive: Don't call cpu_online() on an invalid CPU number

[PATCH v2 1/3] powerpc/xive: Don't call cpu_online() on an invalid CPU number

[Benjamin Herrenschmidt]

If the interrupt didn't have a selected target yet, we could
call cpu_online() and do other cpumask tests with cpu #-1 which
would result in random outcomes.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
 arch/powerpc/sysdev/xive/common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 9201819..dbd0f45 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -656,7 +656,8 @@ static int xive_irq_set_affinity(struct irq_data *d,
 	/* If existing target is already in the new mask, and is
 	 * online then do nothing.
 	 */
-	if (cpu_online(xd->target) &&
+	if (xd->target != XIVE_INVALID_TARGET &&
+	    cpu_online(xd->target) &&
 	    cpumask_test_cpu(xd->target, cpumask))
 		return IRQ_SET_MASK_OK;
 
-- 
2.9.3

[PATCH v2 2/3] powerpx/xive: Fix irq target selection returning out of bounds cpu#

[Benjamin Herrenschmidt]

xive_pick_irq_target() first tries to construct a mask that is
the intersection of the requested affinity, online CPUs, and
the group of CPUs that are on the same chip as the interrupt
source.

If that resulting mask is empty, we were incorrectly returning
nr_cpu_ids as a target.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
 arch/powerpc/sysdev/xive/common.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index dbd0f45..f37d257 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -486,7 +486,7 @@ static int xive_pick_irq_target(struct irq_data *d,
 
 	/*
 	 * If we have chip IDs, first we try to build a mask of
-	 * CPUs matching ther CPU and find a target in there
+	 * CPUs matching the CPU and find a target in there
 	 */
 	if (xd->src_chip != XIVE_INVALID_CHIP_ID &&
 		zalloc_cpumask_var(&mask, GFP_ATOMIC)) {
@@ -497,7 +497,9 @@ static int xive_pick_irq_target(struct irq_data *d,
 				cpumask_set_cpu(cpu, mask);
 		}
 		/* Try to find a target */
-		if (!cpumask_empty(mask))
+		if (cpumask_empty(mask))
+			cpu = -1;
+		else
 			cpu = xive_find_target_in_mask(mask, fuzz++);
 		free_cpumask_var(mask);
 		if (cpu >= 0)
-- 
2.9.3

[PATCH v2 3/3] powerpc/xive: Extra sanity checks on cpu numbers

[Benjamin Herrenschmidt]

When targetting interrupts we do various manipulations of cpu numbers
and CPU masks. This adds some sanity checking to ensure we don't
break assumptions and manpulate cpu numbers that are out of bounds
of the various cpumasks.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
 arch/powerpc/sysdev/xive/common.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index f37d257..f78a779 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -421,8 +421,10 @@ static void xive_dec_target_count(int cpu)
 	struct xive_cpu *xc = per_cpu(xive_cpu, cpu);
 	struct xive_q *q = &xc->queue[xive_irq_priority];
 
-	if (WARN_ON(cpu < 0))
+	if (unlikely(WARN_ON(cpu < 0 || !xc))) {
+		pr_err("%s: cpu=%d xc=%p\n", __func__, cpu, xc);
 		return;
+	}
 
 	/*
 	 * We increment the "pending count" which will be used
@@ -446,8 +448,14 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
 
 	/* Locate it */
 	cpu = cpumask_first(mask);
-	for (i = 0; i < first; i++)
+	for (i = 0; i < first && cpu < nr_cpu_ids; i++)
 		cpu = cpumask_next(cpu, mask);
+
+	/* Sanity check */
+	if (WARN_ON(cpu >= nr_cpu_ids))
+		cpu = cpumask_first(cpu_online_mask);
+
+	/* Remember first one to handle wrap-around */
 	first = cpu;
 
 	/*
@@ -540,6 +548,12 @@ static unsigned int xive_irq_startup(struct irq_data *d)
 		pr_warn("XIVE: irq %d started with broken affinity\n",
 			d->irq);
 	}
+
+	/* Sanity check */
+	if (WARN_ON(target == XIVE_INVALID_TARGET ||
+		    target >= nr_cpu_ids))
+		target = smp_processor_id();
+
 	xd->target = target;
 
 	/*
@@ -670,6 +684,10 @@ static int xive_irq_set_affinity(struct irq_data *d,
 	if (target == XIVE_INVALID_TARGET)
 		return -ENXIO;
 
+	/* Sanity check */
+	if (WARN_ON(target >= nr_cpu_ids))
+		target = smp_processor_id();
+
 	old_target = xd->target;
 
 	/*
-- 
2.9.3