lkml.org 
[lkml]   [2012]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] x86: check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt
    Posting this patch to fix an issue concerning sparse irq's that I raised
    a while back. There was discussion about adding refcounting to sparse
    irqs (to fix other potential race conditions), but that does not appear to
    have been addressed yet. This covers the only issue of this type that I've
    encountered in this area.




    A NULL pointer dereference can occur in smp_irq_move_cleanup_interrupt() if
    we haven't yet setup the irq_cfg pointer in the irq_desc.irq_data.chip_data.

    In create_irq_nr() there is a window where we have set vector_irq in
    __assign_irq_vector(), but not yet called irq_set_chip_data() to set the
    irq_cfg pointer.

    Should an IRQ_MOVE_CLEANUP_VECTOR hit the cpu in question during this time,
    smp_irq_move_cleanup_interrupt() will attempt to process the aforementioned
    irq, but panic when accessing irq_cfg.

    Only continue processing the irq if irq_cfg is non-NULL.

    Signed-off-by: Dimitri Sivanich <sivanich@sgi.com>
    ---
    arch/x86/kernel/apic/io_apic.c | 3 +++
    1 file changed, 3 insertions(+)

    Index: linux/arch/x86/kernel/apic/io_apic.c
    ===================================================================
    --- linux.orig/arch/x86/kernel/apic/io_apic.c
    +++ linux/arch/x86/kernel/apic/io_apic.c
    @@ -2257,6 +2257,9 @@ asmlinkage void smp_irq_move_cleanup_int
    continue;

    cfg = irq_cfg(irq);
    + if (!cfg)
    + continue;
    +
    raw_spin_lock(&desc->lock);

    /*

    \
     
     \ /
      Last update: 2012-10-16 15:41    [W:0.026 / U:0.540 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site