Content-Type: multipart/mixed; boundary="===============8355266593067174830==" MIME-Version: 1.0 From: Greg Kroah-Hartman To: lkp@lists.01.org Subject: [PATCH 4.6 85/96] cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble Date: Mon, 08 Aug 2016 21:11:48 +0200 Message-ID: <20160808180247.635413096@linuxfoundation.org> In-Reply-To: <20160808180243.898163389@linuxfoundation.org> List-Id: --===============8355266593067174830== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable 4.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Thomas Gleixner commit a7c734140aa36413944eef0f8c660e0e2256357d upstream. Xiaolong Ye reported lock debug warnings triggered by the following commit: 8de4a0066106 ("perf/x86: Convert the core to the hotplug state machine") The bug is the following: the cpuhp_bp_states[] array is cut short when CONFIG_SMP=3Dn, but the dynamically registered callbacks are stored neverth= eless and happily scribble outside of the array bounds... We need to store them in case that the state is unregistered so we can invo= ke the teardown function. That's independent of CONFIG_SMP. Make sure the array is large enough. Reported-by: kernel test robot Signed-off-by: Thomas Gleixner Cc: Adam Borowski Cc: Alexander Shishkin Cc: Anna-Maria Gleixner Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Jiri Olsa Cc: Kan Liang Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Sebastian Andrzej Siewior Cc: Stephane Eranian Cc: Vince Weaver Cc: lkp(a)01.org Cc: tipbuild(a)zytor.com Fixes: cff7d378d3fd "cpu/hotplug: Convert to a state machine for the contro= l processor" Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1607122144560.4083(a)nanos Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman --- kernel/cpu.c | 2 ++ 1 file changed, 2 insertions(+) --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -1218,6 +1218,8 @@ static struct cpuhp_step cpuhp_bp_states .teardown =3D takedown_cpu, .cant_stop =3D true, }, +#else + [CPUHP_BRINGUP_CPU] =3D { }, #endif }; = --===============8355266593067174830==--