File 5adda097-x86-HPET-fix-race-triggering-ASSERT.patch of Package xen.7985
# Commit 8c02a19230502a9522b097ee15742599091064aa
# Date 2018-04-23 11:00:07 +0200
# Author David Wang <davidwang@zhaoxin.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/HPET: fix race triggering ASSERT(cpu < nr_cpu_ids)
CPUs may share an in-use channel. Hence clearing of a bit from the
cpumask (in hpet_broadcast_exit()) as well as setting one (in
hpet_broadcast_enter()) must not race evaluation of that same cpumask.
Therefore avoid evaluating the cpumask twice in hpet_detach_channel().
Otherwise cpumask_empty() may e.g.return false while the subsequent
cpumask_first() could return nr_cpu_ids, which then triggers the
assertion in cpumask_of() reached through set_channel_irq_affinity().
Signed-off-by: David Wang <davidwang@zhaoxin.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/hpet.c
+++ b/xen/arch/x86/hpet.c
@@ -509,6 +509,8 @@ static void hpet_attach_channel(unsigned
static void hpet_detach_channel(unsigned int cpu,
struct hpet_event_channel *ch)
{
+ unsigned int next;
+
spin_lock_irq(&ch->lock);
ASSERT(ch == per_cpu(cpu_bc_channel, cpu));
@@ -517,7 +519,7 @@ static void hpet_detach_channel(unsigned
if ( cpu != ch->cpu )
spin_unlock_irq(&ch->lock);
- else if ( cpumask_empty(ch->cpumask) )
+ else if ( (next = cpumask_first(ch->cpumask)) >= nr_cpu_ids )
{
ch->cpu = -1;
clear_bit(HPET_EVT_USED_BIT, &ch->flags);
@@ -525,7 +527,7 @@ static void hpet_detach_channel(unsigned
}
else
{
- ch->cpu = cpumask_first(ch->cpumask);
+ ch->cpu = next;
set_channel_irq_affinity(ch);
local_irq_enable();
}