Blob Blame History Raw
From: Olaf Hering <ohering@suse.de>
Subject: xen: avoid crash in disable_hotplug_cpu
Patch-mainline: never, different patch required
References: bsc#1106594

The command 'xl vcpu-set 0 0', issued in dom0, will crash dom0:

BUG: unable to handle kernel NULL pointer dereference at 00000000000002d8
RIP: e030:device_offline+0x9/0xb0
Call Trace:
 handle_vcpu_hotplug_event+0xb5/0xc0

This happens because handle_vcpu_hotplug_event is called twice. In the
first iteration cpu_present is still true, in the second iteration
cpu_present is false which causes get_cpu_device to return NULL.
In case of cpu#0, cpu_online is apparently always true.

Fix this crash by checking if the cpu was actually offlined by
device_offline, otherwise leave the cpu_present state as it is.

--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -23,6 +23,8 @@ static void disable_hotplug_cpu(int cpu)
 		device_offline(get_cpu_device(cpu));
 		unlock_device_hotplug();
 	}
+	if (cpu_online(cpu))
+		return;
 	if (cpu_present(cpu))
 		xen_arch_unregister_cpu(cpu);