• Joerg Roedel's avatar
    x86/irq: Check for valid irq descriptor in check_irq_vectors_for_cpu_disable() · d97eb896
    Joerg Roedel authored
    When an interrupt is migrated away from a cpu it will stay
    in its vector_irq array until smp_irq_move_cleanup_interrupt
    succeeded. The cfg->move_in_progress flag is cleared already
    when the IPI was sent.
    
    When the interrupt is destroyed after migration its 'struct
    irq_desc' is freed and the vector_irq arrays are cleaned up.
    But since cfg->move_in_progress is already 0 the references
    at cpus before the last migration will not be cleared. So
    this would leave a reference to an already destroyed irq
    alive.
    
    When the cpu is taken down at this point, the
    check_irq_vectors_for_cpu_disable() function finds a valid irq
    number in the vector_irq array, but gets NULL for its
    descriptor and dereferences it, causing a kernel panic.
    
    This has been observed on real systems at shutdown. Add a
    check to check_irq_vectors_for_cpu_disable() for a valid
    'struct irq_desc' to prevent this issue.
    Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
    Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
    Reviewed-by: default avatarJiang Liu <jiang.liu@linux.intel.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Jan Beulich <JBeulich@suse.com>
    Cc: K. Y. Srinivasan <kys@microsoft.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Prarit Bhargava <prarit@redhat.com>
    Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
    Cc: Yinghai Lu <yinghai@kernel.org>
    Cc: alnovak@suse.com
    Cc: joro@8bytes.org
    Link: http://lkml.kernel.org/r/20150204132754.GA10078@suse.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    d97eb896
irq.c 12.6 KB