aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChris Redpath <chris.redpath@arm.com>2014-06-11 14:08:40 +0100
committerJon Medhurst <tixy@linaro.org>2014-06-11 15:08:35 +0100
commit4378062f289e67259f017f6b176ee385dc974836 (patch)
tree0797cd6fc66c81a5b55d71f660b8fd2c7a95c957
parentd1df056f9e6dd9707037ed74621e170dfa8f4c52 (diff)
downloadmp-4378062f289e67259f017f6b176ee385dc974836.tar.gz
sched: hmp: fix out-of-range CPU possiblebig-LITTLE-MP-14.06
If someone hotplugs all the little CPUs while another CPU is handling a wakeup, we can potentially return new_cpu == NR_CPUS from hmp_select_slower_cpu (which is called internally by hmp_best_little_cpu as well). We will use this to deref the per_cpu rq array in hmp_next_down_delay which can go boom. Signed-off-by: Chris Redpath <chris.redpath@arm.com> Signed-off-by: Jon Medhurst <tixy@linaro.org>
-rw-r--r--kernel/sched/fair.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index ffa643c..26c43b4 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4456,7 +4456,11 @@ unlock:
#else
new_cpu = hmp_select_slower_cpu(p, prev_cpu);
#endif
- if (new_cpu != prev_cpu) {
+ /*
+ * we might have no suitable CPU
+ * in which case new_cpu == NR_CPUS
+ */
+ if (new_cpu < NR_CPUS && new_cpu != prev_cpu) {
hmp_next_down_delay(&p->se, new_cpu);
trace_sched_hmp_migrate(p, new_cpu, HMP_MIGRATE_WAKEUP);
return new_cpu;