From: Kamal Mostafa <kamal@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Jiang Liu <jiang.liu@linux.intel.com>,
Jeremiah Mahler <jmmahler@gmail.com>,
andy.shevchenko@gmail.com, Guenter Roeck <linux@roeck-us.net>,
Thomas Gleixner <tglx@linutronix.de>,
Kamal Mostafa <kamal@canonical.com>
Subject: [PATCH 4.2.y-ckt 26/59] x86/irq: Fix a race in x86_vector_free_irqs()
Date: Mon, 9 May 2016 12:55:44 -0700 [thread overview]
Message-ID: <1462823777-8384-27-git-send-email-kamal@canonical.com> (raw)
In-Reply-To: <1462823777-8384-1-git-send-email-kamal@canonical.com>
4.2.8-ckt10 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jiang Liu <jiang.liu@linux.intel.com>
commit 111abeba67e0dbdc26537429de9155e4f1d807d8 upstream.
There's a race condition between
x86_vector_free_irqs()
{
free_apic_chip_data(irq_data->chip_data);
xxxxx //irq_data->chip_data has been freed, but the pointer
//hasn't been reset yet
irq_domain_reset_irq_data(irq_data);
}
and
smp_irq_move_cleanup_interrupt()
{
raw_spin_lock(&vector_lock);
data = apic_chip_data(irq_desc_get_irq_data(desc));
access data->xxxx // may access freed memory
raw_spin_unlock(&desc->lock);
}
which may cause smp_irq_move_cleanup_interrupt() to access freed memory.
Call irq_domain_reset_irq_data(), which clears the pointer with vector lock
held.
[ tglx: Free memory outside of lock held region. ]
Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com>
Tested-by: Borislav Petkov <bp@alien8.de>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Cc: Jeremiah Mahler <jmmahler@gmail.com>
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck <linux@roeck-us.net>
Link: http://lkml.kernel.org/r/1450880014-11741-3-git-send-email-jiang.liu@linux.intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[ kamal: backport to 4.2-stable; prereq for
1bdb897 x86/apic: Handle zero vector gracefully in clear_vector_irq() ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/kernel/apic/vector.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index ea4ba83..7889bec 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -225,9 +225,7 @@ static int assign_irq_vector_policy(int irq, int node,
static void clear_irq_vector(int irq, struct apic_chip_data *data)
{
int cpu, vector;
- unsigned long flags;
- raw_spin_lock_irqsave(&vector_lock, flags);
BUG_ON(!data->cfg.vector);
vector = data->cfg.vector;
@@ -237,10 +235,8 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data)
data->cfg.vector = 0;
cpumask_clear(data->domain);
- if (likely(!data->move_in_progress)) {
- raw_spin_unlock_irqrestore(&vector_lock, flags);
+ if (likely(!data->move_in_progress))
return;
- }
for_each_cpu_and(cpu, data->old_domain, cpu_online_mask) {
for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
@@ -252,7 +248,6 @@ static void clear_irq_vector(int irq, struct apic_chip_data *data)
}
}
data->move_in_progress = 0;
- raw_spin_unlock_irqrestore(&vector_lock, flags);
}
void init_irq_alloc_info(struct irq_alloc_info *info,
@@ -273,19 +268,24 @@ void copy_irq_alloc_info(struct irq_alloc_info *dst, struct irq_alloc_info *src)
static void x86_vector_free_irqs(struct irq_domain *domain,
unsigned int virq, unsigned int nr_irqs)
{
+ struct apic_chip_data *apic_data;
struct irq_data *irq_data;
+ unsigned long flags;
int i;
for (i = 0; i < nr_irqs; i++) {
irq_data = irq_domain_get_irq_data(x86_vector_domain, virq + i);
if (irq_data && irq_data->chip_data) {
+ raw_spin_lock_irqsave(&vector_lock, flags);
clear_irq_vector(virq + i, irq_data->chip_data);
- free_apic_chip_data(irq_data->chip_data);
+ apic_data = irq_data->chip_data;
+ irq_domain_reset_irq_data(irq_data);
+ raw_spin_unlock_irqrestore(&vector_lock, flags);
+ free_apic_chip_data(apic_data);
#ifdef CONFIG_X86_IO_APIC
if (virq + i < nr_legacy_irqs())
legacy_irq_data[virq + i] = NULL;
#endif
- irq_domain_reset_irq_data(irq_data);
}
}
}
--
2.7.4
next prev parent reply other threads:[~2016-05-09 20:07 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-09 19:55 [4.2.y-ckt stable] Linux 4.2.8-ckt10 stable review Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 01/59] x86/mm/32: Enable full randomization on i386 and X86_32 Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 02/59] USB: usbip: fix potential out-of-bounds write Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 03/59] ASoC: rt5640: Correct the digital interface data select Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 04/59] ASoC: dapm: Make sure we have a card when displaying component widgets Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 05/59] ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 06/59] iio: ak8975: Fix NULL pointer exception on early interrupt Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 07/59] iio: ak8975: fix maybe-uninitialized warning Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 08/59] i2c: cpm: Fix build break due to incompatible pointer types Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 09/59] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 10/59] efi: Fix out-of-bounds read in variable_matches() Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 11/59] USB: serial: cp210x: add ID for Link ECU Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 12/59] USB: serial: cp210x: add Straizona Focusers device ids Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 13/59] [media] v4l2-dv-timings.h: fix polarity for 4k formats Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 14/59] ALSA: hda - Add dock support for ThinkPad X260 Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 15/59] workqueue: fix ghost PENDING flag while doing MQ IO Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 16/59] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 17/59] drm/virtio: send vblank event after crtc updates Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 18/59] cxl: Keep IRQ mappings on context teardown Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 19/59] drm/i915: Fix system resume if PCI device remained enabled Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 20/59] drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 21/59] drm/i915: Fix eDP low vswing for Broadwell Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 22/59] drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 23/59] mac80211: fix statistics leak if dev_alloc_name() fails Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 24/59] drm/radeon: fix vertical bars appear on monitor (v2) Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 25/59] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel Kamal Mostafa
2016-05-09 19:55 ` Kamal Mostafa [this message]
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 27/59] x86/apic: Handle zero vector gracefully in clear_vector_irq() Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 28/59] ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 29/59] IB/security: Restrict use of the write() interface Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 30/59] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 31/59] mm: vmscan: reclaim highmem zone if buffer_heads is over limit Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 32/59] EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 33/59] powerpc: Fix bad inline asm constraint in create_zero_mask() Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 34/59] Minimal fix-up of bad hashing behavior of hash_64() Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 35/59] drm/amdgpu: set metadata pointer to NULL after freeing Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 36/59] tracing: Don't display trigger file for events that can't be enabled Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 37/59] drm/radeon: make sure vertical front porch is at least 1 Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 38/59] drm/amdgpu: " Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 39/59] MAINTAINERS: Remove asterisk from EFI directory names Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 40/59] ACPICA: Dispatcher: Update thread ID for recursive method calls Kamal Mostafa
2016-05-09 19:55 ` [PATCH 4.2.y-ckt 41/59] ARC: Add missing io barriers to io{read,write}{16,32}be() Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 42/59] x86/sysfb_efi: Fix valid BAR address range check Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 43/59] fs/pnode.c: treat zero mnt_group_id-s as unequal Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 44/59] propogate_mnt: Handle the first propogated copy being a slave Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 45/59] writeback: Fix performance regression in wb_over_bg_thresh() Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 46/59] mm, cma: prevent nr_isolated_* counters from going negative Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 47/59] x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 48/59] parisc: fix a bug when syscall number of tracee is __NR_Linux_syscalls Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 49/59] jme: Do not enable NIC WoL functions on S0 Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 50/59] jme: Fix device PM wakeup API usage Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 51/59] net/mlx4_en: fix spurious timestamping callbacks Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 52/59] batman-adv: Reduce refcnt of removed router when updating route Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 53/59] batman-adv: Check skb size before using encapsulated ETH+VLAN header Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 54/59] batman-adv: Fix broadcast/ogm queue limit on a removed interface Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 55/59] mm: update min_free_kbytes from khugepaged after core initialization Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 56/59] ARM: EXYNOS: Properly skip unitialized parent clock in power domain on Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 57/59] net/mlx5e: Fix MLX5E_100BASE_T define Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 58/59] cxgbi: fix uninitialized flowi6 Kamal Mostafa
2016-05-09 19:56 ` [PATCH 4.2.y-ckt 59/59] RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips Kamal Mostafa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1462823777-8384-27-git-send-email-kamal@canonical.com \
--to=kamal@canonical.com \
--cc=andy.shevchenko@gmail.com \
--cc=jiang.liu@linux.intel.com \
--cc=jmmahler@gmail.com \
--cc=kernel-team@lists.ubuntu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).