On 05/15/2015, 11:04 AM, Pan Xinhui wrote: > this patch reverts commit 3440a1 which causes the regression and fix a > list corruption. > > base knowledge: kernel call cp->func using cp->info as its argument. > like cp->func(cp->info); > > current code is totally wrong, as 1) &softirq is at stack. 2) cp->info > don't point to struct call_single_data. > So in remote_softirq_receive, > 1) If the caller had left __try_remote_softirq, dereferencing cp->info > could not fetch the correct value. > 2) And we can't get struct call_single_data *cp anymore. > > The list corruption is below. > __local_trigger will add cp->list into softirq_work_list. But no one > will delete cp->list on behalf of us. > if we can succeed to raise_softirq_irqoff, we must delete it from > softirq_work_list. because we will lost control of pointer cp. > cp is passed in and may be freed later in other places. > > Signed-off-by: Pan Xinhui <xinhuix.pan@xxxxxxxxx> > --- > Changes in v2: > no codes changed from v1, just update the comment. > upstream commit fc21c0 fix this issue, as it removes the total feature. :) > the buggy codes exist in v3.10 and v3.12. Applied fc21c0cff2f425891b28ff6fb6b03b325c977428 to 3.12. Thanks. -- js suse labs -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html