sched: Sched_rt_periodic_timer vs cpu hotplug

commit 047106adcc85e3023da210143a6ab8a55df9e0fc upstream.

Heiko reported a case where a timer interrupt managed to
reference a root_domain structure that was already freed by a
concurrent hot-un-plug operation.

Solve this like the regular sched_domain stuff is also
synchronized, by adding a synchronize_sched() stmt to the free
path, this ensures that a root_domain stays present for any
atomic section that could have observed it.

Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Gregory Haskins <ghaskins@novell.com>
Cc: Siddha Suresh B <suresh.b.siddha@intel.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
LKML-Reference: <1258363873.26714.83.camel@laptop>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/kernel/sched.c b/kernel/sched.c
index 04144dbe9f222739cbfc5d53ac01d7a8550fb71e..dd0dccde5df0224508e5249d3dce57aaadef40df 100644 (file)
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -7925,6 +7925,8 @@ sd_parent_degenerate(struct sched_domain *sd, struct sched_domain *parent)
 
 static void free_rootdomain(struct root_domain *rd)
 {
+       synchronize_sched();
+
        cpupri_cleanup(&rd->cpupri);
 
        free_cpumask_var(rd->rto_mask);