powerpc/mm: Fixup preempt underflow with huge pages

Sebastian Siewior · mpe · commit 08a5bb2921e4 · 2016-03-29T12:08:07.000+11:00
hugepd_free() used __get_cpu_var() once. Nothing ensured that the code accessing the variable did not migrate from one CPU to another and soon this was noticed by Tiejun Chen in 94b09d7 ("powerpc/hugetlb: Replace __get_cpu_var with get_cpu_var"). So we had it fixed. Christoph Lameter was doing his __get_cpu_var() replaces and forgot PowerPC. Then he noticed this and sent his fixed up batch again which got applied as 69111ba ("powerpc: Replace __get_cpu_var uses"). The careful reader will noticed one little detail: get_cpu_var() got replaced with this_cpu_ptr(). So now we have a put_cpu_var() which does a preempt_enable() and nothing that does preempt_disable() so we underflow the preempt counter. Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Christoph Lameter <cl@linux.com> Cc: stable@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
@@ -413,13 +413,13 @@ static void hugepd_free(struct mmu_gather *tlb, void *hugepte)
 {
 	struct hugepd_freelist **batchp;
 
-	batchp = this_cpu_ptr(&hugepd_freelist_cur);
+	batchp = &get_cpu_var(hugepd_freelist_cur);
 
 	if (atomic_read(&tlb->mm->mm_users) < 2 ||
 	    cpumask_equal(mm_cpumask(tlb->mm),
 			  cpumask_of(smp_processor_id()))) {
 		kmem_cache_free(hugepte_cache, hugepte);
-        put_cpu_var(hugepd_freelist_cur);
+		put_cpu_var(hugepd_freelist_cur);
 		return;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -413,13 +413,13 @@ static void hugepd_free(struct mmu_gather tlb, void hugepte)`
`413`	`413`	`{`
`414`	`414`	`struct hugepd_freelist **batchp;`
`415`	`415`
`416`		`- batchp = this_cpu_ptr(&hugepd_freelist_cur);`
	`416`	`+ batchp = &get_cpu_var(hugepd_freelist_cur);`
`417`	`417`
`418`	`418`	`if (atomic_read(&tlb->mm->mm_users) < 2 \|\|`
`419`	`419`	`cpumask_equal(mm_cpumask(tlb->mm),`
`420`	`420`	`cpumask_of(smp_processor_id()))) {`
`421`	`421`	`kmem_cache_free(hugepte_cache, hugepte);`
`422`		`- put_cpu_var(hugepd_freelist_cur);`
	`422`	`+ put_cpu_var(hugepd_freelist_cur);`
`423`	`423`	`return;`
`424`	`424`	`}`
`425`	`425`