linux/arch/x86/kernel/apic
Thomas Gleixner 5a3f75e3f0 x86/irq: Plug irq vector hotplug race
Jin debugged a nasty cpu hotplug race which results in leaking a irq
vector on the newly hotplugged cpu.

cpu N				cpu M
native_cpu_up                   device_shutdown
  do_boot_cpu			  free_msi_irqs
  start_secondary                   arch_teardown_msi_irqs
    smp_callin                        default_teardown_msi_irqs
       setup_vector_irq                  arch_teardown_msi_irq
        __setup_vector_irq		   native_teardown_msi_irq
          lock(vector_lock)		     destroy_irq 
          install vectors
          unlock(vector_lock)
					       lock(vector_lock)
--->                                  	       __clear_irq_vector
                                    	       unlock(vector_lock)
    lock(vector_lock)
    set_cpu_online
    unlock(vector_lock)

This leaves the irq vector(s) which are torn down on CPU M stale in
the vector array of CPU N, because CPU M does not see CPU N online
yet. There is a similar issue with concurrent newly setup interrupts.

The alloc/free protection of irq descriptors does not prevent the
above race, because it merily prevents interrupt descriptors from
going away or changing concurrently.

Prevent this by moving the call to setup_vector_irq() into the
vector_lock held region which protects set_cpu_online():

cpu N				cpu M
native_cpu_up                   device_shutdown
  do_boot_cpu			  free_msi_irqs
  start_secondary                   arch_teardown_msi_irqs
    smp_callin                        default_teardown_msi_irqs
       lock(vector_lock)                arch_teardown_msi_irq
       setup_vector_irq()
        __setup_vector_irq		   native_teardown_msi_irq
          install vectors		     destroy_irq 
       set_cpu_online
       unlock(vector_lock)
					       lock(vector_lock)
                                  	       __clear_irq_vector
                                    	       unlock(vector_lock)

So cpu M either sees the cpu N online before clearing the vector or
cpu N installs the vectors after cpu M has cleared it.

Reported-by: xiao jin <jin.xiao@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Link: http://lkml.kernel.org/r/20150705171102.141898931@linutronix.de
2015-07-07 11:54:04 +02:00
..
apic_flat_64.c x86, apic: Remove enable_apic_mode callback 2014-07-31 08:05:44 -07:00
apic_noop.c x86, apic: Remove enable_apic_mode callback 2014-07-31 08:05:44 -07:00
apic_numachip.c x86/apic/numachip: Fix sibling map with NumaChip 2015-03-12 16:58:59 +01:00
apic.c x86/apic: Remove verify_local_APIC() 2015-04-01 10:47:57 +02:00
bigsmp_32.c x86, apic: Remove enable_apic_mode callback 2014-07-31 08:05:44 -07:00
htirq.c x86: Constify irqdomain ops 2015-05-05 11:14:48 +02:00
hw_nmi.c x86/nmi: Fix use of unallocated cpumask_var_t 2014-11-25 14:15:30 -05:00
io_apic.c x86/asm/entry/irq: Clean up IRQn_VECTOR macros 2015-05-10 12:34:28 +02:00
ipi.c x86: Delete non-required instances of include <linux/init.h> 2014-01-06 21:25:18 -08:00
Makefile x86, irq: Move HT IRQ related code from io_apic.c into htirq.c 2014-12-16 14:08:17 +01:00
msi.c x86/irq/msi: Implement irq_set_vcpu_affinity for remapped MSI irqs 2015-05-19 15:51:17 +02:00
probe_32.c x86, apic: Remove enable_apic_mode callback 2014-07-31 08:05:44 -07:00
probe_64.c x86/platform: Introduce APIC post-initialization callback 2012-06-06 09:06:19 +02:00
vector.c x86/irq: Plug irq vector hotplug race 2015-07-07 11:54:04 +02:00
x2apic_cluster.c x86: fix more deprecated cpu function usage. 2015-03-10 13:54:40 +10:30
x2apic_phys.c x86/x2apic: Acpi_gbl_FADT existence depends on CONFIG_ACPI 2015-05-05 14:01:37 +02:00
x2apic_uv_x.c x86/apic/uv: Update the UV APIC HUB check 2015-04-10 10:16:08 +02:00