From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1759437AbcLUSe4 (ORCPT <rfc822;w@1wt.eu>);
        Wed, 21 Dec 2016 13:34:56 -0500
Received: from Galois.linutronix.de ([146.0.238.70]:59920 "EHLO
        Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1757659AbcLUSez (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 21 Dec 2016 13:34:55 -0500
Date: Wed, 21 Dec 2016 19:32:06 +0100 (CET)
From: Thomas Gleixner <tglx@linutronix.de>
To: LKML <linux-kernel@vger.kernel.org>
cc: LAK <linux-arm-kernel@lists.infradead.org>,
        Zhengyu Shen <zhengyu.shen@nxp.com>, Frank Li <frank.li@nxp.com>,
        Shawn Guo <shawnguo@kernel.org>,
        Sebastian Sewior <bigeasy@linutronix.de>
Subject: Re: ARM: imx: mmdc: Fix completely broken cpu hotplug code
In-Reply-To: <alpine.DEB.2.20.1612211917490.3424@nanos>
Message-ID: <alpine.DEB.2.20.1612211928430.3424@nanos>
References: <alpine.DEB.2.20.1612211917490.3424@nanos>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, 21 Dec 2016, Thomas Gleixner wrote:
> The cpu hotplug support of this perf driver is broken in several ways:
> 
> 1) It adds a instance before setting up the state.
> 
> 2) The state for the instance is different from the state of the
>    callback. It's just a randomly chosen state.
> 
> 3) The instance registration is not error checked so nobody noticed that
>    the call can never succeed.
> 
> 4) The state for the multi install callbacks is chosen randomly and
>    overwrites existing state. This is now prevented by the core code so the
>    call is guaranteed to fail.
> 
> 5) The error exit path in the init function leaves the instance registered
>    and then frees the memory which contains the enqueued hlist node.
> 
> 6) The remove function is removing the state and not the instance.
> 
> Fix it by:
> 
> - Setting up the state before adding instances. Use a dynamically allocated
>   state for it.
> 
> - Install instances after the state has been set up
> 
> - Remove the instance in the error path before freeing memory
> 
> - Remove instance not the state in the driver remove callback
> 
> While at is use raw_cpu_processor_id(), because cpu_processor_id() cannot
> be used in preemptible context, and set the driver data after successful
> registration of the pmu.
> 
> Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver")
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: Zhengyu Shen <zhengyu.shen@nxp.com>
> Cc: Frank Li <frank.li@nxp.com>
> Cc: Shawn Guo <shawnguo@kernel.org>

Shawn,

as I have the final hotplug notifier removal pending here, which will break
also the compilation of this driver, I would prefer to merge that through
my tree before the removal patches to avoid build breakage.

Thanks,

	tglx