Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1297484
| From | Jiang Liu <jiang.liu@linux.intel.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [Bugfix v2 3/5] x86/irq: Fix a race window in x86_vector_free_irqs() |
| Date | 2015-12-23 15:20 +0100 |
| Message-ID | <qISqJ-2fv-13@gated-at.bofh.it> (permalink) |
| References | <qHwsh-7Xj-15@gated-at.bofh.it> <qISqJ-2fv-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
There's a race condition between x86_vector_free_irqs()
{
free_apic_chip_data(irq_data->chip_data);
xxxxx //irq_data->chip_data has been freed, but the pointer
//hasn't been reset yet
irq_domain_reset_irq_data(irq_data);
}
and smp_irq_move_cleanup_interrupt()
{
raw_spin_lock(&vector_lock);
data = apic_chip_data(irq_desc_get_irq_data(desc));
access data->xxxx // may access freed memory
raw_spin_unlock(&desc->lock);
}
, which may cause smp_irq_move_cleanup_interrupt() accesses freed memory.
So use vector_lock to guard all memory free code in x86_vector_free_irqs().
Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com>
---
arch/x86/kernel/apic/vector.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index b32c6ef7b4b0..f648fce39d5e 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -228,23 +228,16 @@ static int assign_irq_vector_policy(int irq, int node,
static void clear_irq_vector(int irq, struct apic_chip_data *data)
{
struct irq_desc *desc;
- unsigned long flags;
- int cpu, vector;
-
- raw_spin_lock_irqsave(&vector_lock, flags);
- BUG_ON(!data->cfg.vector);
+ int cpu, vector = data->cfg.vector;
- vector = data->cfg.vector;
+ BUG_ON(!vector);
for_each_cpu_and(cpu, data->domain, cpu_online_mask)
per_cpu(vector_irq, cpu)[vector] = VECTOR_UNUSED;
-
data->cfg.vector = 0;
cpumask_clear(data->domain);
- if (likely(!data->move_in_progress)) {
- raw_spin_unlock_irqrestore(&vector_lock, flags);
+ if (likely(!data->move_in_progress))
return;
- }
desc = irq_to_desc(irq);
for_each_cpu_and(cpu, data->old_domain, cpu_online_mask) {
@@ -257,7 +250,7 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data)
}
}
data->move_in_progress = 0;
- raw_spin_unlock_irqrestore(&vector_lock, flags);
+ cpumask_clear(data->old_domain);
}
void init_irq_alloc_info(struct irq_alloc_info *info,
@@ -279,18 +272,21 @@ static void x86_vector_free_irqs(struct irq_domain *domain,
unsigned int virq, unsigned int nr_irqs)
{
struct irq_data *irq_data;
+ unsigned long flags;
int i;
for (i = 0; i < nr_irqs; i++) {
irq_data = irq_domain_get_irq_data(x86_vector_domain, virq + i);
if (irq_data && irq_data->chip_data) {
+ raw_spin_lock_irqsave(&vector_lock, flags);
clear_irq_vector(virq + i, irq_data->chip_data);
free_apic_chip_data(irq_data->chip_data);
+ irq_domain_reset_irq_data(irq_data);
+ raw_spin_unlock_irqrestore(&vector_lock, flags);
#ifdef CONFIG_X86_IO_APIC
if (virq + i < nr_legacy_irqs())
legacy_irq_data[virq + i] = NULL;
#endif
- irq_domain_reset_irq_data(irq_data);
}
}
}
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: [lkp] [x86/irq] 4c24cee6b2: IP-Config: Auto-configuration of network failed Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-14 07:40 +0100
Re: [LKP] [lkp] [x86/irq] 4c24cee6b2: IP-Config: Auto-configuration of network failed "Huang\, Ying" <ying.huang@intel.com> - 2015-12-14 08:00 +0100
Re: [LKP] [lkp] [x86/irq] 4c24cee6b2: IP-Config: Auto-configuration of network failed Borislav Petkov <bp@alien8.de> - 2015-12-14 11:00 +0100
Re: [LKP] [lkp] [x86/irq] 4c24cee6b2: IP-Config: Auto-configuration of network failed Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-15 09:00 +0100
Re: [LKP] [lkp] [x86/irq] 4c24cee6b2: IP-Config: Auto-configuration of network failed Borislav Petkov <bp@alien8.de> - 2015-12-15 11:10 +0100
Re: [LKP] [lkp] [x86/irq] 4c24cee6b2: IP-Config: Auto-configuration of network failed Thomas Gleixner <tglx@linutronix.de> - 2015-12-19 21:40 +0100
[Bugfix v2 5/5] x86/irq: Trivial cleanups for x86 vector allocation code Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-23 15:20 +0100
[Bugfix v2 1/5] x86/irq: Do not reuse struct apic_chip_data.old_domain as temporary buffer Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-23 15:20 +0100
[Bugfix v2 3/5] x86/irq: Fix a race window in x86_vector_free_irqs() Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-23 15:20 +0100
Re: [Bugfix v2 3/5] x86/irq: Fix a race window in x86_vector_free_irqs() Thomas Gleixner <tglx@linutronix.de> - 2015-12-29 14:50 +0100
[Bugfix v2 2/5] x86/irq: Enhance __assign_irq_vector() to rollback in case of failure Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-23 15:20 +0100
Re: [Bugfix v2 2/5] x86/irq: Enhance __assign_irq_vector() to rollback in case of failure Thomas Gleixner <tglx@linutronix.de> - 2015-12-30 20:00 +0100
[Bugfix v2 4/5] x86/irq: Fix a race condition between vector assigning and cleanup Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-23 15:20 +0100
Re: [Bugfix v2 4/5] x86/irq: Fix a race condition between vector assigning and cleanup Borislav Petkov <bp@alien8.de> - 2015-12-23 19:50 +0100
Re: [Bugfix v2 4/5] x86/irq: Fix a race condition between vector assigning and cleanup Thomas Gleixner <tglx@linutronix.de> - 2015-12-30 18:30 +0100
Re: [Bugfix v2 4/5] x86/irq: Fix a race condition between vector assigning and cleanup Thomas Gleixner <tglx@linutronix.de> - 2015-12-31 00:00 +0100
Re: [Bugfix v2 1/5] x86/irq: Do not reuse struct apic_chip_data.old_domain as temporary buffer Borislav Petkov <bp@alien8.de> - 2015-12-23 20:20 +0100
Re: [Bugfix v2 1/5] x86/irq: Do not reuse struct apic_chip_data.old_domain as temporary buffer Jeremiah Mahler <jmmahler@gmail.com> - 2015-12-24 06:20 +0100
Re: [Bugfix v2 1/5] x86/irq: Do not reuse struct apic_chip_data.old_domain as temporary buffer Jiang Liu <jiang.liu@linux.intel.com> - 2015-12-28 09:30 +0100
Re: [Bugfix v2 1/5] x86/irq: Do not reuse struct apic_chip_data.old_domain as temporary buffer Jeremiah Mahler <jmmahler@gmail.com> - 2015-12-29 04:30 +0100
Re: [Bugfix v2 1/5] x86/irq: Do not reuse struct apic_chip_data.old_domain as temporary buffer Joe Lawrence <joe.lawrence@stratus.com> - 2015-12-24 15:40 +0100
csiph-web