1
linux/arch/x86
Brandon Phiilps ced5b697a7 x86: Avoid race condition in pci_enable_msix()
Keep chip_data in create_irq_nr and destroy_irq.

When two drivers are setting up MSI-X at the same time via
pci_enable_msix() there is a race.  See this dmesg excerpt:

[   85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X
[   85.170611]   alloc irq_desc for 99 on node -1
[   85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X
[   85.170614]   alloc kstat_irqs on node -1
[   85.170616] alloc irq_2_iommu on node -1
[   85.170617]   alloc irq_desc for 100 on node -1
[   85.170619]   alloc kstat_irqs on node -1
[   85.170621] alloc irq_2_iommu on node -1
[   85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X
[   85.170626]   alloc irq_desc for 101 on node -1
[   85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X
[   85.170630]   alloc kstat_irqs on node -1
[   85.170631] alloc irq_2_iommu on node -1
[   85.170635]   alloc irq_desc for 102 on node -1
[   85.170636]   alloc kstat_irqs on node -1
[   85.170639] alloc irq_2_iommu on node -1
[   85.170646] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000088

As you can see igb and ixgbe are both alternating on create_irq_nr()
via pci_enable_msix() in their probe function.

ixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe
choses irq_desc_ptrs[102] and exits the loop, drops vector_lock and
calls dynamic_irq_init. Then it sets irq_desc_ptrs[102]->chip_data =
NULL via dynamic_irq_init().

igb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[]
via create_irq_nr(). It gets to irq_desc_ptrs[102] and does this:

	cfg_new = irq_desc_ptrs[102]->chip_data;
	if (cfg_new->vector != 0)
		continue;

This hits the NULL deref.

Another possible race exists via pci_disable_msix() in a driver or in
the number of error paths that call free_msi_irqs():

destroy_irq()
dynamic_irq_cleanup() which sets desc->chip_data = NULL
...race window...
desc->chip_data = cfg;

Remove the save and restore code for cfg in create_irq_nr() and
destroy_irq() and take the desc->lock when checking the irq_cfg.

Reported-and-analyzed-by: Brandon Philips <bphilips@suse.de>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
LKML-Reference: <1265793639-15071-3-git-send-email-yinghai@kernel.org>
Signed-off-by: Brandon Phililps <bphilips@suse.de>
Cc: stable@kernel.org
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2010-02-10 14:27:28 -08:00
..
boot x86: add support for LZO-compressed kernels 2010-01-11 09:34:05 -08:00
configs
crypto Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 2009-12-01 15:16:22 +08:00
ia32 x86: get rid of the insane TIF_ABI_PENDING bit 2010-01-29 08:22:01 -08:00
include/asm Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2010-02-01 10:42:35 -08:00
kernel x86: Avoid race condition in pci_enable_msix() 2010-02-10 14:27:28 -08:00
kvm KVM: PIT: control word is write-only 2010-02-09 19:20:15 +02:00
lguest lguest: move panic notifier registration to its expected place. 2009-09-23 22:26:44 +09:30
lib Merge branch 'iommu/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/linux-2.6-iommu into x86/urgent 2009-12-28 09:23:13 +01:00
math-emu
mm memory hotplug: fix a bug on /dev/mem for 64-bit kernels 2010-02-02 18:11:23 -08:00
oprofile oprofile/x86: add Xeon 7500 series support 2010-01-25 15:34:53 +01:00
pci x86/PCI: remove IOH range fetching 2010-01-28 08:24:11 -08:00
power hw-breakpoints: Rewrite the hw-breakpoints layer on top of perf events 2009-11-08 15:34:42 +01:00
tools Merge branch 'iommu/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/linux-2.6-iommu into x86/urgent 2009-12-28 09:23:13 +01:00
vdso sysctl x86: Remove dead binary sysctl support 2009-11-12 02:05:04 -08:00
video
xen x86: xen: 64-bit kernel RPL should be 0 2010-01-13 11:23:54 +01:00
Kbuild
Kconfig x86: Remove "x86 CPU features in debugfs" (CONFIG_X86_CPU_DEBUG) 2010-01-23 18:27:47 -08:00
Kconfig.cpu Revert "x86: Side-step lguest problem by only building cmpxchg8b_emu for pre-Pentium" 2010-01-05 16:01:35 -08:00
Kconfig.debug Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2009-12-11 20:47:30 -08:00
Makefile Merge branch 'perf/core' into perf/probes 2009-11-17 10:17:47 +01:00
Makefile_32.cpu Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2009-12-08 13:38:11 -08:00