Messages in this thread Patch in this message | | | Date | Wed, 25 Jul 2012 18:17:54 +0900 | From | Tomoki Sekiyama <> | Subject | [PATCH] x86/ioapic: Fix NULL pointer dereference on CPU hotplug after disabling irqs |
| |
Hi,
In current Linux, percpu variable `vector_irq' is not always cleared when a CPU is offlined. If the cpu that has the disabled irqs in vector_irq is hotplugged again, __setup_vector_irq() hits invalid irq vector and may crash.
Commit f6175f5bfb4c partially fixes this, but was not enough in environments with IOMMU IRQ remapper.
This bug can be reproduced as following; # echo 0 > /sys/devices/system/cpu/cpu7/online # modprobe -r some_driver_using_interrupts # vector_irq@cpu7 uncleared # echo 1 > /sys/devices/system/cpu/cpu7/online # kernel may crash
This patch fixes this bug by clearing vector_irq in __fixup_irqs() when the cpu is offlined.
Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama.qu@hitachi.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Suresh Siddha <suresh.b.siddha@intel.com> Cc: Yinghai Lu <yinghai@kernel.org> Cc: Alexander Gordeev <agordeev@redhat.com> --- arch/x86/kernel/irq.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c index 3dafc60..d27b27d 100644 --- a/arch/x86/kernel/irq.c +++ b/arch/x86/kernel/irq.c @@ -328,6 +328,7 @@ void fixup_irqs(void) chip->irq_retrigger(data); raw_spin_unlock(&desc->lock); } + __this_cpu_write(vector_irq[vector], -1); } } #endif -- 1.7.7.6 -- Tomoki Sekiyama <tomoki.sekiyama.qu@hitachi.com> Linux Technology Center Hitachi, Ltd., Yokohama Research Laboratory
| |