Files
linux/include/linux
Brandon Phiilps 0a660e1ef1 x86: Avoid race condition in pci_enable_msix()
commit ced5b697a7 upstream.

Keep chip_data in create_irq_nr and destroy_irq.

When two drivers are setting up MSI-X at the same time via
pci_enable_msix() there is a race.  See this dmesg excerpt:

[   85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X
[   85.170611]   alloc irq_desc for 99 on node -1
[   85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X
[   85.170614]   alloc kstat_irqs on node -1
[   85.170616] alloc irq_2_iommu on node -1
[   85.170617]   alloc irq_desc for 100 on node -1
[   85.170619]   alloc kstat_irqs on node -1
[   85.170621] alloc irq_2_iommu on node -1
[   85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X
[   85.170626]   alloc irq_desc for 101 on node -1
[   85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X
[   85.170630]   alloc kstat_irqs on node -1
[   85.170631] alloc irq_2_iommu on node -1
[   85.170635]   alloc irq_desc for 102 on node -1
[   85.170636]   alloc kstat_irqs on node -1
[   85.170639] alloc irq_2_iommu on node -1
[   85.170646] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000088

As you can see igb and ixgbe are both alternating on create_irq_nr()
via pci_enable_msix() in their probe function.

ixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe
choses irq_desc_ptrs[102] and exits the loop, drops vector_lock and
calls dynamic_irq_init. Then it sets irq_desc_ptrs[102]->chip_data =
NULL via dynamic_irq_init().

igb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[]
via create_irq_nr(). It gets to irq_desc_ptrs[102] and does this:

	cfg_new = irq_desc_ptrs[102]->chip_data;
	if (cfg_new->vector != 0)
		continue;

This hits the NULL deref.

Another possible race exists via pci_disable_msix() in a driver or in
the number of error paths that call free_msi_irqs():

destroy_irq()
dynamic_irq_cleanup() which sets desc->chip_data = NULL
...race window...
desc->chip_data = cfg;

Remove the save and restore code for cfg in create_irq_nr() and
destroy_irq() and take the desc->lock when checking the irq_cfg.

Reported-and-analyzed-by: Brandon Philips <bphilips@suse.de>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
LKML-Reference: <1265793639-15071-3-git-send-email-yinghai@kernel.org>
Signed-off-by: Brandon Phililps <bphilips@suse.de>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-15 08:50:06 -07:00
..
2009-09-23 07:39:29 -07:00
2009-09-09 11:19:00 -04:00
2010-02-09 04:50:44 -08:00
2009-09-20 16:09:20 +05:30
2009-09-08 17:42:50 -07:00
2010-01-25 10:49:40 -08:00
2010-01-06 15:04:49 -08:00
2009-07-12 12:22:34 -07:00
2009-09-23 11:01:25 -07:00
2009-07-14 20:29:57 +08:00
2009-09-18 09:48:52 -07:00
2009-09-14 17:41:42 -07:00
2009-07-08 09:18:05 -07:00
2009-09-12 14:48:40 +02:00
2009-09-01 01:13:31 -07:00
2010-01-28 15:01:20 -08:00
2009-09-01 17:52:57 -07:00
2009-09-11 12:54:58 -07:00
2009-08-19 23:08:24 +04:00
2009-07-26 19:25:44 -07:00
2009-06-29 08:59:10 +10:00
2010-02-09 04:50:55 -08:00
2009-07-31 08:55:48 +02:00
2009-09-23 07:39:41 -07:00
2009-09-26 10:17:19 -07:00
2009-08-29 15:53:00 +02:00
2009-09-30 00:32:06 -04:00
2009-09-23 07:39:58 -07:00
2009-09-19 13:13:17 -07:00
2009-09-26 10:17:19 -07:00
2009-09-22 07:17:33 -07:00
2009-09-18 21:22:08 +02:00
2009-07-30 16:03:45 +09:30
2009-09-23 07:39:41 -07:00
2009-09-22 07:17:35 -07:00
2009-07-08 09:31:56 -07:00
2009-09-21 15:14:51 +02:00
2009-09-26 10:17:19 -07:00
2009-09-22 07:17:47 -07:00
2009-10-04 15:05:10 -07:00
2009-07-29 19:10:36 -07:00
2009-09-23 07:39:41 -07:00
2009-08-23 19:13:02 -07:00
2009-09-01 12:48:21 -04:00
2009-08-28 19:57:30 -04:00
2009-10-30 12:25:12 -07:00
2009-08-31 18:08:51 +02:00
2009-10-29 07:39:25 -07:00
2010-01-18 10:19:11 -08:00
2010-02-09 04:50:55 -08:00
2009-07-06 13:57:03 -07:00
2009-09-02 01:03:43 -07:00
2009-08-30 22:26:34 +02:00
2009-09-23 06:46:23 -07:00
2009-09-23 18:13:10 -07:00
2009-08-26 12:39:29 +01:00
2009-09-23 22:26:32 +09:30
2009-09-22 07:17:30 -07:00
2009-09-19 13:13:25 -07:00
2009-11-19 13:43:06 -08:00
2009-09-15 16:51:30 +02:00