• Tomoki Sekiyama's avatar
    x86/ioapic: Fix NULL pointer dereference on CPU hotplug after disabling irqs · 1d44b30f
    Tomoki Sekiyama authored
    In the current kernel, percpu variable `vector_irq' is not always
    cleared when a CPU is offlined. If the CPU that has the disabled
    irqs in vector_irq is hotplugged again, __setup_vector_irq()
    hits invalid irq vector and may crash.
    
    This bug can be reproduced as following;
    
     # echo 0 > /sys/devices/system/cpu/cpu7/online
     # modprobe -r some_driver_using_interrupts     # vector_irq@cpu7 uncleared
     # echo 1 > /sys/devices/system/cpu/cpu7/online # kernel may crash
    
    To fix this problem, this patch clears vector_irq in
    __fixup_irqs() when the CPU is offlined.
    
    This also reverts commit f6175f5b, which partially fixes
    this bug by clearing vector in __clear_irq_vector(). But in
    environments with IOMMU IRQ remapper, it could fail because
    cfg->domain doesn't contain offlined CPUs. With this patch, the
    fix in __clear_irq_vector() can be reverted because every
    vector_irq is already cleared in __fixup_irqs() on offlined CPUs.
    Signed-off-by: default avatarTomoki Sekiyama <tomoki.sekiyama.qu@hitachi.com>
    Acked-by: default avatarSuresh Siddha <suresh.b.siddha@intel.com>
    Cc: yrl.pp-manager.tt@hitachi.com
    Cc: Yinghai Lu <yinghai@kernel.org>
    Cc: Alexander Gordeev <agordeev@redhat.com>
    Link: http://lkml.kernel.org/r/20120726104732.2889.19144.stgit@kvmdevSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    1d44b30f
io_apic.c 95.3 KB