scsi: bnx2fc: Plug CPU hotplug race
authorThomas Gleixner <tglx@linutronix.de>
Mon, 24 Jul 2017 10:52:56 +0000 (12:52 +0200)
committerMartin K. Petersen <martin.petersen@oracle.com>
Thu, 27 Jul 2017 01:51:24 +0000 (21:51 -0400)
commit8addebc14a322fa8ca67cd57c6038069acde8ddc
tree3fb5ee2628099fb5a7159e61d1acbcff180002ed
parent2c67521821acd900d7508f37e49d0b494011106d
scsi: bnx2fc: Plug CPU hotplug race

bnx2fc_process_new_cqes() has protection against CPU hotplug, which relies
on the per cpu thread pointer. This protection is racy because it happens
only partially with the per cpu fp_work_lock held.

If the CPU is unplugged after the lock is dropped, the wakeup code can
dereference a NULL pointer or access freed and potentially reused memory.

Restructure the code so the thread check and wakeup happens with the
fp_work_lock held.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Chad Dupuis <chad.dupuis@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/bnx2fc/bnx2fc_hwi.c