<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/lib/cpu_rmap.c, branch v4.19.310</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=v4.19.310</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=v4.19.310'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2023-06-14T08:57:13+00:00</updated>
<entry>
<title>lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()</title>
<updated>2023-06-14T08:57:13+00:00</updated>
<author>
<name>Ben Hutchings</name>
<email>ben@decadent.org.uk</email>
</author>
<published>2023-06-02T18:28:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=53f16fa73f71abfcac67e71a5513653b8db28b76'/>
<id>urn:sha1:53f16fa73f71abfcac67e71a5513653b8db28b76</id>
<content type='text'>
[ Upstream commit 7c5d4801ecf0564c860033d89726b99723c55146 ]

irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap.
So we need to clear the pointer to our glue structure in rmap before
doing that, not after.

Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap-&gt;obj array entries")
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
Reviewed-by: Simon Horman &lt;simon.horman@corigine.com&gt;
Link: https://lore.kernel.org/r/ZHo0vwquhOy3FaXc@decadent.org.uk
Signed-off-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
</entry>
<entry>
<title>lib: cpu_rmap: Avoid use after free on rmap-&gt;obj array entries</title>
<updated>2023-05-30T11:42:09+00:00</updated>
<author>
<name>Eli Cohen</name>
<email>elic@nvidia.com</email>
</author>
<published>2023-02-08T05:51:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=d1308bd0b24cb1d78fa2747d5fa3e055cc628a48'/>
<id>urn:sha1:d1308bd0b24cb1d78fa2747d5fa3e055cc628a48</id>
<content type='text'>
[ Upstream commit 4e0473f1060aa49621d40a113afde24818101d37 ]

When calling irq_set_affinity_notifier() with NULL at the notify
argument, it will cause freeing of the glue pointer in the
corresponding array entry but will leave the pointer in the array. A
subsequent call to free_irq_cpu_rmap() will try to free this entry again
leading to possible use after free.

Fix that by setting NULL to the array entry and checking that we have
non-zero at the array entry when iterating over the array in
free_irq_cpu_rmap().

The current code does not suffer from this since there are no cases
where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the
notify arg) is called, followed by a call to free_irq_cpu_rmap() so we
don't hit and issue. Subsequent patches in this series excersize this
flow, hence the required fix.

Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Signed-off-by: Eli Cohen &lt;elic@nvidia.com&gt;
Signed-off-by: Saeed Mahameed &lt;saeedm@nvidia.com&gt;
Reviewed-by: Jacob Keller &lt;jacob.e.keller@intel.com&gt;
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
</entry>
<entry>
<title>sched/topology: Rename topology_thread_cpumask() to topology_sibling_cpumask()</title>
<updated>2015-05-27T13:22:15+00:00</updated>
<author>
<name>Bartosz Golaszewski</name>
<email>bgolaszewski@baylibre.com</email>
</author>
<published>2015-05-26T13:11:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=06931e62246844c73fba24d7aeb4a5dc897a2739'/>
<id>urn:sha1:06931e62246844c73fba24d7aeb4a5dc897a2739</id>
<content type='text'>
Rename topology_thread_cpumask() to topology_sibling_cpumask()
for more consistency with scheduler code.

Signed-off-by: Bartosz Golaszewski &lt;bgolaszewski@baylibre.com&gt;
Reviewed-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Acked-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Acked-by: Catalin Marinas &lt;catalin.marinas@arm.com&gt;
Cc: Benoit Cousson &lt;bcousson@baylibre.com&gt;
Cc: Fenghua Yu &lt;fenghua.yu@intel.com&gt;
Cc: Guenter Roeck &lt;linux@roeck-us.net&gt;
Cc: Jean Delvare &lt;jdelvare@suse.de&gt;
Cc: Jonathan Corbet &lt;corbet@lwn.net&gt;
Cc: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Oleg Drokin &lt;oleg.drokin@intel.com&gt;
Cc: Peter Zijlstra &lt;peterz@infradead.org&gt;
Cc: Rafael J. Wysocki &lt;rjw@rjwysocki.net&gt;
Cc: Russell King &lt;linux@arm.linux.org.uk&gt;
Cc: Viresh Kumar &lt;viresh.kumar@linaro.org&gt;
Link: http://lkml.kernel.org/r/1432645896-12588-2-git-send-email-bgolaszewski@baylibre.com
Signed-off-by: Ingo Molnar &lt;mingo@kernel.org&gt;
</content>
</entry>
<entry>
<title>Remove GENERIC_HARDIRQ config option</title>
<updated>2013-09-13T13:09:52+00:00</updated>
<author>
<name>Martin Schwidefsky</name>
<email>schwidefsky@de.ibm.com</email>
</author>
<published>2013-08-30T07:39:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=0244ad004a54e39308d495fee0a2e637f8b5c317'/>
<id>urn:sha1:0244ad004a54e39308d495fee0a2e637f8b5c317</id>
<content type='text'>
After the last architecture switched to generic hard irqs the config
options HAVE_GENERIC_HARDIRQS &amp; GENERIC_HARDIRQS and the related code
for !CONFIG_GENERIC_HARDIRQS can be removed.

Signed-off-by: Martin Schwidefsky &lt;schwidefsky@de.ibm.com&gt;
</content>
</entry>
<entry>
<title>lib: cpu_rmap: avoid flushing all workqueues</title>
<updated>2013-01-11T22:54:54+00:00</updated>
<author>
<name>David Decotigny</name>
<email>decot@googlers.com</email>
</author>
<published>2013-01-11T22:31:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=896f97ea95c1d29c0520ee0766b66b7f64cb967c'/>
<id>urn:sha1:896f97ea95c1d29c0520ee0766b66b7f64cb967c</id>
<content type='text'>
In some cases, free_irq_cpu_rmap() is called while holding a lock (eg
rtnl).  This can lead to deadlocks, because it invokes
flush_scheduled_work() which ends up waiting for whole system workqueue
to flush, but some pending works might try to acquire the lock we are
already holding.

This commit uses reference-counting to replace
irq_run_affinity_notifiers().  It also removes
irq_run_affinity_notifiers() altogether.

[akpm@linux-foundation.org: eliminate free_cpu_rmap, rename cpu_rmap_reclaim() to cpu_rmap_release(), propagate kref_put() retval from cpu_rmap_put()]
Signed-off-by: David Decotigny &lt;decot@googlers.com&gt;
Reviewed-by: Ben Hutchings &lt;bhutchings@solarflare.com&gt;
Acked-by: Eric Dumazet &lt;edumazet@google.com&gt;
Reviewed-by: Josh Triplett &lt;josh@joshtriplett.org&gt;
Cc: "David S. Miller" &lt;davem@davemloft.net&gt;
Cc: Or Gerlitz &lt;ogerlitz@mellanox.com&gt;
Acked-by: Amir Vadai &lt;amirv@mellanox.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
</entry>
<entry>
<title>lib: reduce the use of module.h wherever possible</title>
<updated>2012-03-07T20:04:04+00:00</updated>
<author>
<name>Paul Gortmaker</name>
<email>paul.gortmaker@windriver.com</email>
</author>
<published>2011-11-17T02:29:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=8bc3bcc93a2b4e47d5d410146f6546bca6171663'/>
<id>urn:sha1:8bc3bcc93a2b4e47d5d410146f6546bca6171663</id>
<content type='text'>
For files only using THIS_MODULE and/or EXPORT_SYMBOL, map
them onto including export.h -- or if the file isn't even
using those, then just delete the include.  Fix up any implicit
include dependencies that were being masked by module.h along
the way.

Signed-off-by: Paul Gortmaker &lt;paul.gortmaker@windriver.com&gt;
</content>
</entry>
<entry>
<title>lib: cpu_rmap: CPU affinity reverse-mapping</title>
<updated>2011-01-24T22:51:56+00:00</updated>
<author>
<name>Ben Hutchings</name>
<email>bhutchings@solarflare.com</email>
</author>
<published>2011-01-19T11:03:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=c39649c331c70952700f99832b03f87e9d7f5b4b'/>
<id>urn:sha1:c39649c331c70952700f99832b03f87e9d7f5b4b</id>
<content type='text'>
When initiating I/O on a multiqueue and multi-IRQ device, we may want
to select a queue for which the response will be handled on the same
or a nearby CPU.  This requires a reverse-map of IRQ affinity.  Add
library functions to support a generic reverse-mapping from CPUs to
objects with affinity and the specific case where the objects are
IRQs.

Signed-off-by: Ben Hutchings &lt;bhutchings@solarflare.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
</feed>
