[PATCH] check return value of cpu_callback



Spawing ksoftirqd, migration, or watchdog, and calling init_timers_cpu() may
fail with small memory. If it happens in initcalls, kernel NULL pointer
dereference happens later. This patch makes crash happen immediately in
such cases. It seems a bit better than getting kernel NULL pointer
dereference later.

CC: Ingo Molnar <mingo@xxxxxxx>
Signed-off-by: Akinobu Mita <mita@xxxxxxxxxxxxxxxx>

kernel/sched.c | 4 +++-
kernel/softirq.c | 4 +++-
kernel/softlockup.c | 3 ++-
kernel/timer.c | 4 +++-
4 files changed, 11 insertions(+), 4 deletions(-)

Index: work-failmalloc/kernel/softirq.c
===================================================================
--- work-failmalloc.orig/kernel/softirq.c
+++ work-failmalloc/kernel/softirq.c
@@ -612,7 +612,9 @@ static struct notifier_block __cpuinitda
__init int spawn_ksoftirqd(void)
{
void *cpu = (void *)(long)smp_processor_id();
- cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
+ int err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
+
+ BUG_ON(err == NOTIFY_BAD);
cpu_callback(&cpu_nfb, CPU_ONLINE, cpu);
register_cpu_notifier(&cpu_nfb);
return 0;
Index: work-failmalloc/kernel/softlockup.c
===================================================================
--- work-failmalloc.orig/kernel/softlockup.c
+++ work-failmalloc/kernel/softlockup.c
@@ -149,8 +149,9 @@ static struct notifier_block __cpuinitda
__init void spawn_softlockup_task(void)
{
void *cpu = (void *)(long)smp_processor_id();
+ int err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);

- cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
+ BUG_ON(err == NOTIFY_BAD);
cpu_callback(&cpu_nfb, CPU_ONLINE, cpu);
register_cpu_notifier(&cpu_nfb);

Index: work-failmalloc/kernel/sched.c
===================================================================
--- work-failmalloc.orig/kernel/sched.c
+++ work-failmalloc/kernel/sched.c
@@ -5237,9 +5237,11 @@ static struct notifier_block __cpuinitda
int __init migration_init(void)
{
void *cpu = (void *)(long)smp_processor_id();
+ int err;

/* Start one for the boot CPU: */
- migration_call(&migration_notifier, CPU_UP_PREPARE, cpu);
+ err = migration_call(&migration_notifier, CPU_UP_PREPARE, cpu);
+ BUG_ON(err == NOTIFY_BAD);
migration_call(&migration_notifier, CPU_ONLINE, cpu);
register_cpu_notifier(&migration_notifier);

Index: work-failmalloc/kernel/timer.c
===================================================================
--- work-failmalloc.orig/kernel/timer.c
+++ work-failmalloc/kernel/timer.c
@@ -1715,8 +1715,10 @@ static struct notifier_block __cpuinitda

void __init init_timers(void)
{
- timer_cpu_notify(&timers_nb, (unsigned long)CPU_UP_PREPARE,
+ int err = timer_cpu_notify(&timers_nb, (unsigned long)CPU_UP_PREPARE,
(void *)(long)smp_processor_id());
+
+ BUG_ON(err == NOTIFY_BAD);
register_cpu_notifier(&timers_nb);
open_softirq(TIMER_SOFTIRQ, run_timer_softirq, NULL);
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



Relevant Pages

  • Re: your mail
    ... that disappeared after the module init function. ... and the pointer in the kernel gets dereferenced to junk. ... send the line "unsubscribe linux-kernel" in ...
    (Linux-Kernel)
  • Kernel null pointer dereference in fget()
    ... we're faced with the following crash: ... dereference at virtual address 0000009b ... Feb 15 08:16:45 kernel: printing eip: ... Feb 15 08:16:45 kernel: Unable to handle kernel NULL pointer ...
    (comp.os.linux)
  • patch debugfs-kernel-doc-fixes-for-debugfs.patch added to gregkh-2.6 tree
    ... Subject: Debugfs: kernel-doc fixes for debugfs ... a pointer to a string containing the name of the file to create. ... * This function will return a pointer to a dentry if it succeeds. ... + * If debugfs is not enabled in the kernel, ...
    (Linux-Kernel)
  • Re: Crash with recent kernel on wireless
    ... build and install a kernel, you get two kernel images on 7.x; ... Dump Length: 190091264B ... Attempt to extract a component of a value that is not a structure ... pointer. ...
    (freebsd-net)
  • Re: Crash with recent kernel on wireless
    ... build and install a kernel, you get two kernel images on 7.x; ... Dump Length: 190091264B ... Attempt to extract a component of a value that is not a structure ... pointer. ...
    (freebsd-stable)