diff mbox series

core/cpu: Fix memory allocation for job array

Message ID 20180903130321.10938-1-svaidy@linux.vnet.ibm.com
State Accepted
Headers show
Series core/cpu: Fix memory allocation for job array | expand

Checks

Context Check Description
snowpatch_ozlabs/apply_patch success master/apply_patch Successfully applied
snowpatch_ozlabs/make_check success Test make_check on branch master

Commit Message

Vaidyanathan Srinivasan Sept. 3, 2018, 1:03 p.m. UTC
fixes: 7a3f307e core/cpu: parallelise global CPU register setting jobs

This bug would result in boot-hang on some configurations due to
cpu_wait_job() endlessly waiting for the last bogus jobs[cpu->pir] pointer.

Reported-by: Stephanie Swanson <swanman@us.ibm.com>
Reported-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Reviewed-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
---
 core/cpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Vaidyanathan Srinivasan Sept. 3, 2018, 1:15 p.m. UTC | #1
* Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com> [2018-09-03 18:33:21]:

> fixes: 7a3f307e core/cpu: parallelise global CPU register setting jobs
> 
> This bug would result in boot-hang on some configurations due to
> cpu_wait_job() endlessly waiting for the last bogus jobs[cpu->pir] pointer.
> 
> Reported-by: Stephanie Swanson <swanman@us.ibm.com>
> Reported-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
> Reviewed-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
> Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
> Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
> Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
> ---
>  core/cpu.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/core/cpu.c b/core/cpu.c
> index 88477f82..cc5b88c5 100644
> --- a/core/cpu.c
> +++ b/core/cpu.c
> @@ -1373,7 +1373,7 @@ static int64_t cpu_change_all_hid0(struct hid0_change_req *req)
>  	struct cpu_thread *cpu;
>  	struct cpu_job **jobs;
> 
> -	jobs = zalloc(sizeof(struct cpu_job *) * cpu_max_pir + 1);
> +	jobs = zalloc(sizeof(struct cpu_job *) * (cpu_max_pir + 1));
>  	assert(jobs);
> 
>  	for_each_available_cpu(cpu) {
> @@ -1424,7 +1424,7 @@ static int64_t cpu_cleanup_all(void)
>  	struct cpu_thread *cpu;
>  	struct cpu_job **jobs;
> 
> -	jobs = zalloc(sizeof(struct cpu_job *) * cpu_max_pir + 1);
> +	jobs = zalloc(sizeof(struct cpu_job *) * (cpu_max_pir + 1));
>  	assert(jobs);
> 
>  	for_each_available_cpu(cpu) {

Thanks Vasant and Nick for pointing out the second instance.

This is the second version of the patch posted at
https://patchwork.ozlabs.org/patch/965016/

--Vaidy
Stewart Smith Sept. 13, 2018, 8:54 a.m. UTC | #2
Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com> writes:
> fixes: 7a3f307e core/cpu: parallelise global CPU register setting jobs
>
> This bug would result in boot-hang on some configurations due to
> cpu_wait_job() endlessly waiting for the last bogus jobs[cpu->pir] pointer.
>
> Reported-by: Stephanie Swanson <swanman@us.ibm.com>
> Reported-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
> Reviewed-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
> Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
> Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
> Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
> ---
>  core/cpu.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Thanks. Merged to master as of df5da053c459369b4fc4a831dd09ce1859efe436.
diff mbox series

Patch

diff --git a/core/cpu.c b/core/cpu.c
index 88477f82..cc5b88c5 100644
--- a/core/cpu.c
+++ b/core/cpu.c
@@ -1373,7 +1373,7 @@  static int64_t cpu_change_all_hid0(struct hid0_change_req *req)
 	struct cpu_thread *cpu;
 	struct cpu_job **jobs;
 
-	jobs = zalloc(sizeof(struct cpu_job *) * cpu_max_pir + 1);
+	jobs = zalloc(sizeof(struct cpu_job *) * (cpu_max_pir + 1));
 	assert(jobs);
 
 	for_each_available_cpu(cpu) {
@@ -1424,7 +1424,7 @@  static int64_t cpu_cleanup_all(void)
 	struct cpu_thread *cpu;
 	struct cpu_job **jobs;
 
-	jobs = zalloc(sizeof(struct cpu_job *) * cpu_max_pir + 1);
+	jobs = zalloc(sizeof(struct cpu_job *) * (cpu_max_pir + 1));
 	assert(jobs);
 
 	for_each_available_cpu(cpu) {