Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1257340

[PATCH 3.13.y-ckt 09/48] powerpc/MSI: Fix race condition in tearing down MSI interrupts

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.13.y-ckt 09/48] powerpc/MSI: Fix race condition in tearing down MSI interrupts
Date 2015-10-27 22:50 +0100
Message-ID <qoki0-21H-73@gated-at.bofh.it> (permalink)
References <qok8h-1XT-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt29 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Mackerras <paulus@ozlabs.org>

commit e297c939b745e420ef0b9dc989cb87bda617b399 upstream.

This fixes a race which can result in the same virtual IRQ number
being assigned to two different MSI interrupts.  The most visible
consequence of that is usually a warning and stack trace from the
sysfs code about an attempt to create a duplicate entry in sysfs.

The race happens when one CPU (say CPU 0) is disposing of an MSI
while another CPU (say CPU 1) is setting up an MSI.  CPU 0 calls
(for example) pnv_teardown_msi_irqs(), which calls
msi_bitmap_free_hwirqs() to indicate that the MSI (i.e. its
hardware IRQ number) is no longer in use.  Then, before CPU 0 gets
to calling irq_dispose_mapping() to free up the virtal IRQ number,
CPU 1 comes in and calls msi_bitmap_alloc_hwirqs() to allocate an
MSI, and gets the same hardware IRQ number that CPU 0 just freed.
CPU 1 then calls irq_create_mapping() to get a virtual IRQ number,
which sees that there is currently a mapping for that hardware IRQ
number and returns the corresponding virtual IRQ number (which is
the same virtual IRQ number that CPU 0 was using).  CPU 0 then
calls irq_dispose_mapping() and frees that virtual IRQ number.
Now, if another CPU comes along and calls irq_create_mapping(), it
is likely to get the virtual IRQ number that was just freed,
resulting in the same virtual IRQ number apparently being used for
two different hardware interrupts.

To fix this race, we just move the call to msi_bitmap_free_hwirqs()
to after the call to irq_dispose_mapping().  Since virq_to_hw()
doesn't work for the virtual IRQ number after irq_dispose_mapping()
has been called, we need to call it before irq_dispose_mapping() and
remember the result for the msi_bitmap_free_hwirqs() call.

The pattern of calling msi_bitmap_free_hwirqs() before
irq_dispose_mapping() appears in 5 places under arch/powerpc, and
appears to have originated in commit 05af7bd2d75e ("[POWERPC] MPIC
U3/U4 MSI backend") from 2007.

Fixes: 05af7bd2d75e ("[POWERPC] MPIC U3/U4 MSI backend")
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[ kamal: backport to 3.19-stable: pasemi/msi.c -->
  arch/powerpc/sysdev/mpic_pasemi_msi.c ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/powerpc/platforms/powernv/pci.c  | 5 +++--
 arch/powerpc/sysdev/fsl_msi.c         | 5 +++--
 arch/powerpc/sysdev/mpic_pasemi_msi.c | 5 +++--
 arch/powerpc/sysdev/mpic_u3msi.c      | 5 +++--
 arch/powerpc/sysdev/ppc4xx_msi.c      | 5 +++--
 5 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index 5bd801b..2f32872 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -108,6 +108,7 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
 	struct pci_controller *hose = pci_bus_to_host(pdev->bus);
 	struct pnv_phb *phb = hose->private_data;
 	struct msi_desc *entry;
+	irq_hw_number_t hwirq;
 
 	if (WARN_ON(!phb))
 		return;
@@ -115,10 +116,10 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
 	list_for_each_entry(entry, &pdev->msi_list, list) {
 		if (entry->irq == NO_IRQ)
 			continue;
+		hwirq = virq_to_hw(entry->irq);
 		irq_set_msi_desc(entry->irq, NULL);
-		msi_bitmap_free_hwirqs(&phb->msi_bmp,
-			virq_to_hw(entry->irq) - phb->msi_base, 1);
 		irq_dispose_mapping(entry->irq);
+		msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq - phb->msi_base, 1);
 	}
 }
 #endif /* CONFIG_PCI_MSI */
diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index 77efbae..4a9b367 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -121,15 +121,16 @@ static void fsl_teardown_msi_irqs(struct pci_dev *pdev)
 {
 	struct msi_desc *entry;
 	struct fsl_msi *msi_data;
+	irq_hw_number_t hwirq;
 
 	list_for_each_entry(entry, &pdev->msi_list, list) {
 		if (entry->irq == NO_IRQ)
 			continue;
+		hwirq = virq_to_hw(entry->irq);
 		msi_data = irq_get_chip_data(entry->irq);
 		irq_set_msi_desc(entry->irq, NULL);
-		msi_bitmap_free_hwirqs(&msi_data->bitmap,
-				       virq_to_hw(entry->irq), 1);
 		irq_dispose_mapping(entry->irq);
+		msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
 	}
 
 	return;
diff --git a/arch/powerpc/sysdev/mpic_pasemi_msi.c b/arch/powerpc/sysdev/mpic_pasemi_msi.c
index 38e6238..e873616 100644
--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c
+++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c
@@ -74,6 +74,7 @@ static int pasemi_msi_check_device(struct pci_dev *pdev, int nvec, int type)
 static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
 {
 	struct msi_desc *entry;
+	irq_hw_number_t hwirq;
 
 	pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev);
 
@@ -81,10 +82,10 @@ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
 		if (entry->irq == NO_IRQ)
 			continue;
 
+		hwirq = virq_to_hw(entry->irq);
 		irq_set_msi_desc(entry->irq, NULL);
-		msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
-				       virq_to_hw(entry->irq), ALLOC_CHUNK);
 		irq_dispose_mapping(entry->irq);
+		msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, ALLOC_CHUNK);
 	}
 
 	return;
diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c
index 9a7aa0e..dfc3486 100644
--- a/arch/powerpc/sysdev/mpic_u3msi.c
+++ b/arch/powerpc/sysdev/mpic_u3msi.c
@@ -124,15 +124,16 @@ static int u3msi_msi_check_device(struct pci_dev *pdev, int nvec, int type)
 static void u3msi_teardown_msi_irqs(struct pci_dev *pdev)
 {
 	struct msi_desc *entry;
+	irq_hw_number_t hwirq;
 
         list_for_each_entry(entry, &pdev->msi_list, list) {
 		if (entry->irq == NO_IRQ)
 			continue;
 
+		hwirq = virq_to_hw(entry->irq);
 		irq_set_msi_desc(entry->irq, NULL);
-		msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
-				       virq_to_hw(entry->irq), 1);
 		irq_dispose_mapping(entry->irq);
+		msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1);
 	}
 
 	return;
diff --git a/arch/powerpc/sysdev/ppc4xx_msi.c b/arch/powerpc/sysdev/ppc4xx_msi.c
index 43948da..c3e6512 100644
--- a/arch/powerpc/sysdev/ppc4xx_msi.c
+++ b/arch/powerpc/sysdev/ppc4xx_msi.c
@@ -121,16 +121,17 @@ void ppc4xx_teardown_msi_irqs(struct pci_dev *dev)
 {
 	struct msi_desc *entry;
 	struct ppc4xx_msi *msi_data = &ppc4xx_msi;
+	irq_hw_number_t hwirq;
 
 	dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n");
 
 	list_for_each_entry(entry, &dev->msi_list, list) {
 		if (entry->irq == NO_IRQ)
 			continue;
+		hwirq = virq_to_hw(entry->irq);
 		irq_set_msi_desc(entry->irq, NULL);
-		msi_bitmap_free_hwirqs(&msi_data->bitmap,
-				virq_to_hw(entry->irq), 1);
 		irq_dispose_mapping(entry->irq);
+		msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
 	}
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt29 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:40 +0100
  [PATCH 3.13.y-ckt 27/48] usb: Use the USB_SS_MULT() macro to get the burst multiplier. Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 16/48] arm64: head.S: initialise mdcr_el2 in el2_setup Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 21/48] x86/platform: Fix Geode LX timekeeping in the generic x86 build Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 07/48] spi: Fix documentation of spi_alloc_master() Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 23/48] arm64: errata: add module build workaround for erratum #843419 Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 03/48] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 15/48] btrfs: skip waiting on ordered range for special files Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 29/48] usb: xhci: Clear XHCI_STATE_DYING on start Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 24/48] arm64: KVM: Disable virtual timer even if the guest is not using it Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 28/48] xhci: give command abortion one more chance before killing xhci Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 18/48] iser-target: remove command with state ISTATE_REMOVE Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 26/48] KVM: x86: trap AMD MSRs for the TSeg base and mask Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 12/48] USB: option: add ZTE PIDs Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 05/48] [stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 11/48] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 14/48] Btrfs: fix read corruption of compressed and shared extents Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 04/48] KEYS: Don't permit request_key() to construct a new keyring Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 25/48] arm: KVM: Disable virtual timer even if the guest is not using it Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 06/48] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 20/48] powerpc/mm: Recompute hash value after a failed update Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 10/48] CIFS: fix type confusion in copy offload ioctl Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 08/48] ARM: 8429/1: disable GCC SRA optimization Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 02/48] KEYS: Fix race between key destruction and finding a keyring by name Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 09/48] powerpc/MSI: Fix race condition in tearing down MSI interrupts Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
  [PATCH 3.13.y-ckt 13/48] x86/apic: Serialize LVTT and TSC_DEADLINE writes Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100

csiph-web