diff options
author | Mike Travis <travis@sgi.com> | 2008-01-30 07:30:55 -0500 |
---|---|---|
committer | Ingo Molnar <mingo@elte.hu> | 2008-01-30 07:30:55 -0500 |
commit | 7bf0c23ed24b0d95a2a717f86dce1f210e16f8a5 (patch) | |
tree | 64f1d21cfcc7746d430c4ad70c864e176536ac8d | |
parent | 0fa376e027f0bd71368e1485f863f0dff8f7c897 (diff) |
x86: prevent dereferencing non-allocated per_cpu variables
'for_each_possible_cpu(i)' when there's a _remote possibility_ of
dereferencing a non-allocated per_cpu variable involved.
All files except mm/vmstat.c are x86 arch.
Thanks to pageexec@freemail.hu for pointing this out.
Signed-off-by: Mike Travis <travis@sgi.com>
Cc: Christoph Lameter <clameter@sgi.com>
Cc: <pageexec@freemail.hu>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-rw-r--r-- | arch/x86/kernel/smp_32.c | 4 | ||||
-rw-r--r-- | arch/x86/kernel/smpboot_32.c | 4 | ||||
-rw-r--r-- | arch/x86/xen/smp.c | 4 |
3 files changed, 6 insertions, 6 deletions
diff --git a/arch/x86/kernel/smp_32.c b/arch/x86/kernel/smp_32.c index fcaa026eb807..d4c01a4aca60 100644 --- a/arch/x86/kernel/smp_32.c +++ b/arch/x86/kernel/smp_32.c | |||
@@ -223,7 +223,7 @@ void send_IPI_mask_sequence(cpumask_t mask, int vector) | |||
223 | */ | 223 | */ |
224 | 224 | ||
225 | local_irq_save(flags); | 225 | local_irq_save(flags); |
226 | for (query_cpu = 0; query_cpu < NR_CPUS; ++query_cpu) { | 226 | for_each_possible_cpu(query_cpu) { |
227 | if (cpu_isset(query_cpu, mask)) { | 227 | if (cpu_isset(query_cpu, mask)) { |
228 | __send_IPI_dest_field(cpu_to_logical_apicid(query_cpu), | 228 | __send_IPI_dest_field(cpu_to_logical_apicid(query_cpu), |
229 | vector); | 229 | vector); |
@@ -675,7 +675,7 @@ static int convert_apicid_to_cpu(int apic_id) | |||
675 | { | 675 | { |
676 | int i; | 676 | int i; |
677 | 677 | ||
678 | for (i = 0; i < NR_CPUS; i++) { | 678 | for_each_possible_cpu(i) { |
679 | if (per_cpu(x86_cpu_to_apicid, i) == apic_id) | 679 | if (per_cpu(x86_cpu_to_apicid, i) == apic_id) |
680 | return i; | 680 | return i; |
681 | } | 681 | } |
diff --git a/arch/x86/kernel/smpboot_32.c b/arch/x86/kernel/smpboot_32.c index 239ada1c499c..0bf7f20baba0 100644 --- a/arch/x86/kernel/smpboot_32.c +++ b/arch/x86/kernel/smpboot_32.c | |||
@@ -1090,7 +1090,7 @@ static void __init smp_boot_cpus(unsigned int max_cpus) | |||
1090 | * Allow the user to impress friends. | 1090 | * Allow the user to impress friends. |
1091 | */ | 1091 | */ |
1092 | Dprintk("Before bogomips.\n"); | 1092 | Dprintk("Before bogomips.\n"); |
1093 | for (cpu = 0; cpu < NR_CPUS; cpu++) | 1093 | for_each_possible_cpu(cpu) |
1094 | if (cpu_isset(cpu, cpu_callout_map)) | 1094 | if (cpu_isset(cpu, cpu_callout_map)) |
1095 | bogosum += cpu_data(cpu).loops_per_jiffy; | 1095 | bogosum += cpu_data(cpu).loops_per_jiffy; |
1096 | printk(KERN_INFO | 1096 | printk(KERN_INFO |
@@ -1121,7 +1121,7 @@ static void __init smp_boot_cpus(unsigned int max_cpus) | |||
1121 | * construct cpu_sibling_map, so that we can tell sibling CPUs | 1121 | * construct cpu_sibling_map, so that we can tell sibling CPUs |
1122 | * efficiently. | 1122 | * efficiently. |
1123 | */ | 1123 | */ |
1124 | for (cpu = 0; cpu < NR_CPUS; cpu++) { | 1124 | for_each_possible_cpu(cpu) { |
1125 | cpus_clear(per_cpu(cpu_sibling_map, cpu)); | 1125 | cpus_clear(per_cpu(cpu_sibling_map, cpu)); |
1126 | cpus_clear(per_cpu(cpu_core_map, cpu)); | 1126 | cpus_clear(per_cpu(cpu_core_map, cpu)); |
1127 | } | 1127 | } |
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c index c1b131bcdcbe..8e1234e14559 100644 --- a/arch/x86/xen/smp.c +++ b/arch/x86/xen/smp.c | |||
@@ -146,7 +146,7 @@ void __init xen_smp_prepare_boot_cpu(void) | |||
146 | old memory can be recycled */ | 146 | old memory can be recycled */ |
147 | make_lowmem_page_readwrite(&per_cpu__gdt_page); | 147 | make_lowmem_page_readwrite(&per_cpu__gdt_page); |
148 | 148 | ||
149 | for (cpu = 0; cpu < NR_CPUS; cpu++) { | 149 | for_each_possible_cpu(cpu) { |
150 | cpus_clear(per_cpu(cpu_sibling_map, cpu)); | 150 | cpus_clear(per_cpu(cpu_sibling_map, cpu)); |
151 | /* | 151 | /* |
152 | * cpu_core_map lives in a per cpu area that is cleared | 152 | * cpu_core_map lives in a per cpu area that is cleared |
@@ -163,7 +163,7 @@ void __init xen_smp_prepare_cpus(unsigned int max_cpus) | |||
163 | { | 163 | { |
164 | unsigned cpu; | 164 | unsigned cpu; |
165 | 165 | ||
166 | for (cpu = 0; cpu < NR_CPUS; cpu++) { | 166 | for_each_possible_cpu(cpu) { |
167 | cpus_clear(per_cpu(cpu_sibling_map, cpu)); | 167 | cpus_clear(per_cpu(cpu_sibling_map, cpu)); |
168 | /* | 168 | /* |
169 | * cpu_core_ map will be zeroed when the per | 169 | * cpu_core_ map will be zeroed when the per |