diff mbox series

core/cpu: Fix theoretical use-after-free if no_return job returns

Message ID 20190603075515.23918-1-stewart@linux.ibm.com
State Accepted
Headers show
Series core/cpu: Fix theoretical use-after-free if no_return job returns | expand

Checks

Context Check Description
snowpatch_ozlabs/apply_patch success Successfully applied on branch master (9cae036fafea468219892406a846639f2715854d)
snowpatch_ozlabs/snowpatch_job_snowpatch-skiboot fail Test snowpatch/job/snowpatch-skiboot on branch master
snowpatch_ozlabs/snowpatch_job_snowpatch-skiboot-dco success Signed-off-by present

Commit Message

Stewart Smith June 3, 2019, 7:55 a.m. UTC
Practically speaking this should/would never happen, but static analysis
caught it, and just *maybe* at some time in the future, someone will
have less of a terrible day debugging something terrible if we fix it.

Signed-off-by: Stewart Smith <stewart@linux.ibm.com>
---
 core/cpu.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Stewart Smith June 5, 2019, 1:41 a.m. UTC | #1
Stewart Smith <stewart@linux.ibm.com> writes:
> Practically speaking this should/would never happen, but static analysis
> caught it, and just *maybe* at some time in the future, someone will
> have less of a terrible day debugging something terrible if we fix it.
>
> Signed-off-by: Stewart Smith <stewart@linux.ibm.com>
> ---
>  core/cpu.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)

Merged to master as of 2d4c7f9886ee45f7c1db933885e5002b76c270ad
diff mbox series

Patch

diff --git a/core/cpu.c b/core/cpu.c
index 62c020174683..641a5d0b7066 100644
--- a/core/cpu.c
+++ b/core/cpu.c
@@ -361,8 +361,12 @@  void cpu_process_jobs(void)
 			free(job);
 		func(data);
 		if (!list_empty(&cpu->locks_held)) {
-			prlog(PR_ERR, "OPAL job %s returning with locks held\n",
-			      job->name);
+			if (no_return)
+				prlog(PR_ERR, "OPAL no-return job returned with"
+				      "locks held!\n");
+			else
+				prlog(PR_ERR, "OPAL job %s returning with locks held\n",
+				      job->name);
 			drop_my_locks(true);
 		}
 		lock(&cpu->job_lock);