aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMike Travis <travis@sgi.com>2008-01-30 07:30:55 -0500
committerIngo Molnar <mingo@elte.hu>2008-01-30 07:30:55 -0500
commit7bf0c23ed24b0d95a2a717f86dce1f210e16f8a5 (patch)
tree64f1d21cfcc7746d430c4ad70c864e176536ac8d
parent0fa376e027f0bd71368e1485f863f0dff8f7c897 (diff)
x86: prevent dereferencing non-allocated per_cpu variables
'for_each_possible_cpu(i)' when there's a _remote possibility_ of dereferencing a non-allocated per_cpu variable involved. All files except mm/vmstat.c are x86 arch. Thanks to pageexec@freemail.hu for pointing this out. Signed-off-by: Mike Travis <travis@sgi.com> Cc: Christoph Lameter <clameter@sgi.com> Cc: <pageexec@freemail.hu> Cc: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-rw-r--r--arch/x86/kernel/smp_32.c4
-rw-r--r--arch/x86/kernel/smpboot_32.c4
-rw-r--r--arch/x86/xen/smp.c4
3 files changed, 6 insertions, 6 deletions
diff --git a/arch/x86/kernel/smp_32.c b/arch/x86/kernel/smp_32.c
index fcaa026eb807..d4c01a4aca60 100644
--- a/arch/x86/kernel/smp_32.c
+++ b/arch/x86/kernel/smp_32.c
@@ -223,7 +223,7 @@ void send_IPI_mask_sequence(cpumask_t mask, int vector)
223 */ 223 */
224 224
225 local_irq_save(flags); 225 local_irq_save(flags);
226 for (query_cpu = 0; query_cpu < NR_CPUS; ++query_cpu) { 226 for_each_possible_cpu(query_cpu) {
227 if (cpu_isset(query_cpu, mask)) { 227 if (cpu_isset(query_cpu, mask)) {
228 __send_IPI_dest_field(cpu_to_logical_apicid(query_cpu), 228 __send_IPI_dest_field(cpu_to_logical_apicid(query_cpu),
229 vector); 229 vector);
@@ -675,7 +675,7 @@ static int convert_apicid_to_cpu(int apic_id)
675{ 675{
676 int i; 676 int i;
677 677
678 for (i = 0; i < NR_CPUS; i++) { 678 for_each_possible_cpu(i) {
679 if (per_cpu(x86_cpu_to_apicid, i) == apic_id) 679 if (per_cpu(x86_cpu_to_apicid, i) == apic_id)
680 return i; 680 return i;
681 } 681 }
diff --git a/arch/x86/kernel/smpboot_32.c b/arch/x86/kernel/smpboot_32.c
index 239ada1c499c..0bf7f20baba0 100644
--- a/arch/x86/kernel/smpboot_32.c
+++ b/arch/x86/kernel/smpboot_32.c
@@ -1090,7 +1090,7 @@ static void __init smp_boot_cpus(unsigned int max_cpus)
1090 * Allow the user to impress friends. 1090 * Allow the user to impress friends.
1091 */ 1091 */
1092 Dprintk("Before bogomips.\n"); 1092 Dprintk("Before bogomips.\n");
1093 for (cpu = 0; cpu < NR_CPUS; cpu++) 1093 for_each_possible_cpu(cpu)
1094 if (cpu_isset(cpu, cpu_callout_map)) 1094 if (cpu_isset(cpu, cpu_callout_map))
1095 bogosum += cpu_data(cpu).loops_per_jiffy; 1095 bogosum += cpu_data(cpu).loops_per_jiffy;
1096 printk(KERN_INFO 1096 printk(KERN_INFO
@@ -1121,7 +1121,7 @@ static void __init smp_boot_cpus(unsigned int max_cpus)
1121 * construct cpu_sibling_map, so that we can tell sibling CPUs 1121 * construct cpu_sibling_map, so that we can tell sibling CPUs
1122 * efficiently. 1122 * efficiently.
1123 */ 1123 */
1124 for (cpu = 0; cpu < NR_CPUS; cpu++) { 1124 for_each_possible_cpu(cpu) {
1125 cpus_clear(per_cpu(cpu_sibling_map, cpu)); 1125 cpus_clear(per_cpu(cpu_sibling_map, cpu));
1126 cpus_clear(per_cpu(cpu_core_map, cpu)); 1126 cpus_clear(per_cpu(cpu_core_map, cpu));
1127 } 1127 }
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index c1b131bcdcbe..8e1234e14559 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -146,7 +146,7 @@ void __init xen_smp_prepare_boot_cpu(void)
146 old memory can be recycled */ 146 old memory can be recycled */
147 make_lowmem_page_readwrite(&per_cpu__gdt_page); 147 make_lowmem_page_readwrite(&per_cpu__gdt_page);
148 148
149 for (cpu = 0; cpu < NR_CPUS; cpu++) { 149 for_each_possible_cpu(cpu) {
150 cpus_clear(per_cpu(cpu_sibling_map, cpu)); 150 cpus_clear(per_cpu(cpu_sibling_map, cpu));
151 /* 151 /*
152 * cpu_core_map lives in a per cpu area that is cleared 152 * cpu_core_map lives in a per cpu area that is cleared
@@ -163,7 +163,7 @@ void __init xen_smp_prepare_cpus(unsigned int max_cpus)
163{ 163{
164 unsigned cpu; 164 unsigned cpu;
165 165
166 for (cpu = 0; cpu < NR_CPUS; cpu++) { 166 for_each_possible_cpu(cpu) {
167 cpus_clear(per_cpu(cpu_sibling_map, cpu)); 167 cpus_clear(per_cpu(cpu_sibling_map, cpu));
168 /* 168 /*
169 * cpu_core_ map will be zeroed when the per 169 * cpu_core_ map will be zeroed when the per