From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D0A5C43142 for ; Thu, 21 Jun 2018 20:21:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D49C82238A for ; Thu, 21 Jun 2018 20:21:52 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D49C82238A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linutronix.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933292AbeFUUVu (ORCPT ); Thu, 21 Jun 2018 16:21:50 -0400 Received: from Galois.linutronix.de ([146.0.238.70]:39738 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932686AbeFUUVt (ORCPT ); Thu, 21 Jun 2018 16:21:49 -0400 Received: from p4fea482e.dip0.t-ipconnect.de ([79.234.72.46] helo=nanos) by Galois.linutronix.de with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1fW65R-00042S-8x; Thu, 21 Jun 2018 22:21:45 +0200 Date: Thu, 21 Jun 2018 22:21:44 +0200 (CEST) From: Thomas Gleixner To: Lukas Wunner cc: Bjorn Helgaas , Mika Westerberg , Sebastian Andrzej Siewior , linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org Subject: Re: [PATCH] genirq: Synchronize only with single thread on free_irq() In-Reply-To: <8f770886632640321592873e4c902218d42c436b.1527194314.git.lukas@wunner.de> Message-ID: References: <8f770886632640321592873e4c902218d42c436b.1527194314.git.lukas@wunner.de> User-Agent: Alpine 2.21 (DEB 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 24 May 2018, Lukas Wunner wrote: > static int irq_wait_for_interrupt(struct irqaction *action) > { > - set_current_state(TASK_INTERRUPTIBLE); > + for (;;) { > + set_current_state(TASK_INTERRUPTIBLE); > > - while (!kthread_should_stop()) { > + if (kthread_should_stop()) { > + /* may need to run one last time. */ > + if (test_and_clear_bit(IRQTF_RUNTHREAD, > + &action->thread_flags)) { > + __set_current_state(TASK_RUNNING); > + return 0; > + } > + __set_current_state(TASK_RUNNING); > + return -1; > + } > > if (test_and_clear_bit(IRQTF_RUNTHREAD, > &action->thread_flags)) { > @@ -766,10 +776,7 @@ static int irq_wait_for_interrupt(struct irqaction *action) > return 0; > } > schedule(); > - set_current_state(TASK_INTERRUPTIBLE); > } > - __set_current_state(TASK_RUNNING); > - return -1; > } > > /* > @@ -990,7 +997,7 @@ static int irq_thread(void *data) > /* > * This is the regular exit path. __free_irq() is stopping the > * thread via kthread_stop() after calling > - * synchronize_irq(). So neither IRQTF_RUNTHREAD nor the > + * synchronize_hardirq(). So neither IRQTF_RUNTHREAD nor the > * oneshot mask bit can be set. We cannot verify that as we > * cannot touch the oneshot mask at this point anymore as > * __setup_irq() might have given out currents thread_mask > @@ -1595,7 +1602,7 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id) > unregister_handler_proc(irq, action); > > /* Make sure it's not being used on another CPU: */ > - synchronize_irq(irq); > + synchronize_hardirq(irq); So after that, action can be freed and when the thread above tries to access it. Nice Use After Free. That needs more thought. Thanks, tglx