From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227lTL5l+FL0LIlQU9cHzhRoi8ilm2e4/nMAGCXHc6WM9xQlom2kD+pu+gE/Y6zhQdFjwC/4 ARC-Seal: i=1; a=rsa-sha256; t=1517256480; cv=none; d=google.com; s=arc-20160816; b=CtBJp+HgHfSEqydekas+Vl+IpVDIyGovPWiEAEE2CsjrxBg0uGLFYfj54kGAoPhDsX 4Wg/umYgq4WOSUjDDhkFHxLe6GZhFiMNCCE32spKuDjZxRB8EuQd5QzxsFvRLXWx+dVS /sjcNv+aubnZg+F5isj6h3M8A2GboN86VSY9feNsrntLjdR5gigMxtduUklzT1g7kiyN WhvFB6XchGt+DfwJRBVW6OO8LPnEfjKvJHdsJ8VDvosgsyhKG5hs6qN1N56NM9LlbUWk T5VTxO5kRPWyuJbTUdEQ909Hk8qifOzu/Zohf07mMCt8fMGjyhHYQ/igvM6384bavszq twXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=nNKqTPVJCbx2bz9bZMZ76upBc+jAwuXBznXCQRavs34=; b=gDuDlpHXHXZ7DZ4rj9BF9zz0sr92FTZnnSKqI4YBRl0RvdqA4qsJzr8gHcsPkJYpbm DLsBwKSbdHNQ/D/gijVDzFVRvVc6L/N1d+FdVeylKDjhhuAdwYDJzB68zPimloec/9iL hS7Ol+PDyrYy6EZ9d4LQshZthJMoPXj6gYnItHnzVk8b3Eu7g8SUhZIJWnLEtBRjJ4s3 UOiH/VABFW3WSGgzv4l+ZrcPpsRp8YyB9tQItPV7bH2QESDSAo9uIwFrwgOQXhRhaT2D 95Apu9kObOrT/sI8eqb/VCF91VeQ3lMNzTsnd8mmewf3LIMl+uLuIFrBVjG3MsFkLput W7tg== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rui Wang , Thomas Gleixner , tony.luck@intel.com, linux-pci@vger.kernel.org, rjw@rjwysocki.net, linux-acpi@vger.kernel.org, bhelgaas@google.com, Ingo Molnar , Joerg Roedel Subject: [PATCH 4.4 26/74] x86/ioapic: Fix incorrect pointers in ioapic_setup_resources() Date: Mon, 29 Jan 2018 13:56:31 +0100 Message-Id: <20180129123848.802267981@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123847.507563674@linuxfoundation.org> References: <20180129123847.507563674@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958732057500823?= X-GMAIL-MSGID: =?utf-8?q?1590958732057500823?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Rui Wang commit 9d98bcec731756b8688b59ec998707924d716d7b upstream. On a 4-socket Brickland system, hot-removing one ioapic is fine. Hot-removing the 2nd one causes panic in mp_unregister_ioapic() while calling release_resource(). It is because the iomem_res pointer has already been released when removing the first ioapic. To explain the use of &res[num] here: res is assigned to ioapic_resources, and later in ioapic_insert_resources() we do: struct resource *r = ioapic_resources; for_each_ioapic(i) { insert_resource(&iomem_resource, r); r++; } Here 'r' is treated as an arry of 'struct resource', and the r++ ensures that each element of the array is inserted separately. Thus we should call release_resouce() on each element at &res[num]. Fix it by assigning the correct pointers to ioapics[i].iomem_res in ioapic_setup_resources(). Signed-off-by: Rui Wang Signed-off-by: Thomas Gleixner Cc: tony.luck@intel.com Cc: linux-pci@vger.kernel.org Cc: rjw@rjwysocki.net Cc: linux-acpi@vger.kernel.org Cc: bhelgaas@google.com Link: http://lkml.kernel.org/r/1465369193-4816-3-git-send-email-rui.y.wang@intel.com Signed-off-by: Ingo Molnar Acked-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman --- arch/x86/kernel/apic/io_apic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kernel/apic/io_apic.c +++ b/arch/x86/kernel/apic/io_apic.c @@ -2592,8 +2592,8 @@ static struct resource * __init ioapic_s res[num].flags = IORESOURCE_MEM | IORESOURCE_BUSY; snprintf(mem, IOAPIC_RESOURCE_NAME_SIZE, "IOAPIC %u", i); mem += IOAPIC_RESOURCE_NAME_SIZE; + ioapics[i].iomem_res = &res[num]; num++; - ioapics[i].iomem_res = res; } ioapic_resources = res;