From patchwork Fri Dec 6 03:21:15 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiang Liu X-Patchwork-Id: 3292761 X-Patchwork-Delegate: bhelgaas@google.com Return-Path: X-Original-To: patchwork-linux-pci@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C2509C0D4A for ; Fri, 6 Dec 2013 03:24:13 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E4F26200CA for ; Fri, 6 Dec 2013 03:24:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id F2BBA204EA for ; Fri, 6 Dec 2013 03:24:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757163Ab3LFDXy (ORCPT ); Thu, 5 Dec 2013 22:23:54 -0500 Received: from mga03.intel.com ([143.182.124.21]:56623 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755457Ab3LFDVL (ORCPT ); Thu, 5 Dec 2013 22:21:11 -0500 Received: from azsmga002.ch.intel.com ([10.2.17.35]) by azsmga101.ch.intel.com with ESMTP; 05 Dec 2013 19:21:11 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.93,838,1378882800"; d="scan'208";a="325986949" Received: from gerry-dev.bj.intel.com ([10.238.158.74]) by AZSMGA002.ch.intel.com with ESMTP; 05 Dec 2013 19:21:07 -0800 From: Jiang Liu To: Joerg Roedel , David Woodhouse , Dan Williams , Vinod Koul , Ashok Raj , Yijing Wang , iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org Cc: Jiang Liu , Tony Luck , Yinghai Lu , linux-pci@vger.kernel.org, dmaengine@vger.kernel.org Subject: [Patch Part1 V2 12/20] iommu/vt-d: fix invalid memory access when freeing DMAR irq Date: Fri, 6 Dec 2013 11:21:15 +0800 Message-Id: <1386300083-6882-13-git-send-email-jiang.liu@linux.intel.com> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1386300083-6882-1-git-send-email-jiang.liu@linux.intel.com> References: <1386300083-6882-1-git-send-email-jiang.liu@linux.intel.com> Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In function free_dmar_iommu(), it sets IRQ handler data to NULL before calling free_irq(), which will cause invalid memory access because free_irq() will access IRQ handler data when calling function dmar_msi_mask(). So only set IRQ handler data to NULL after calling free_irq(). Sample stack dump: [ 13.094010] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [ 13.103215] IP: [] __lock_acquire+0x4d/0x12a0 [ 13.110104] PGD 0 [ 13.112614] Oops: 0000 [#1] SMP [ 13.116585] Modules linked in: [ 13.120260] CPU: 60 PID: 1 Comm: swapper/0 Tainted: G W 3.13.0-rc1-gerry+ #9 [ 13.129367] Hardware name: Intel Corporation LH Pass ........../SVRBD-ROW_T, BIOS SE5C600.86B.99.99.x059.091020121352 09/10/2012 [ 13.142555] task: ffff88042dd38010 ti: ffff88042dd32000 task.ti: ffff88042dd32000 [ 13.151179] RIP: 0010:[] [] __lock_acquire+0x4d/0x12a0 [ 13.160867] RSP: 0000:ffff88042dd33b78 EFLAGS: 00010046 [ 13.166969] RAX: 0000000000000046 RBX: 0000000000000002 RCX: 0000000000000000 [ 13.175122] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000048 [ 13.183274] RBP: ffff88042dd33bd8 R08: 0000000000000002 R09: 0000000000000001 [ 13.191417] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88042dd38010 [ 13.199571] R13: 0000000000000000 R14: 0000000000000048 R15: 0000000000000000 [ 13.207725] FS: 0000000000000000(0000) GS:ffff88103f200000(0000) knlGS:0000000000000000 [ 13.217014] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.223596] CR2: 0000000000000048 CR3: 0000000001a0b000 CR4: 00000000000407e0 [ 13.231747] Stack: [ 13.234160] 0000000000000004 0000000000000046 ffff88042dd33b98 ffffffff810a567d [ 13.243059] ffff88042dd33c08 ffffffff810bb14c ffffffff828995a0 0000000000000046 [ 13.251969] 0000000000000000 0000000000000000 0000000000000002 0000000000000000 [ 13.260862] Call Trace: [ 13.263775] [] ? trace_hardirqs_off+0xd/0x10 [ 13.270571] [] ? vprintk_emit+0x23c/0x570 [ 13.277058] [] lock_acquire+0x93/0x120 [ 13.283269] [] ? dmar_msi_mask+0x47/0x70 [ 13.289677] [] _raw_spin_lock_irqsave+0x49/0x90 [ 13.296748] [] ? dmar_msi_mask+0x47/0x70 [ 13.303153] [] dmar_msi_mask+0x47/0x70 [ 13.309354] [] irq_shutdown+0x53/0x60 [ 13.315467] [] __free_irq+0x26d/0x280 [ 13.321580] [] free_irq+0xf0/0x180 [ 13.327395] [] free_dmar_iommu+0x271/0x2b0 [ 13.333996] [] ? trace_hardirqs_on+0xd/0x10 [ 13.340696] [] free_iommu+0x17/0x50 [ 13.346597] [] init_dmars+0x691/0x77a [ 13.352711] [] intel_iommu_init+0x351/0x438 [ 13.359400] [] ? iommu_setup+0x27d/0x27d [ 13.365806] [] pci_iommu_init+0x28/0x52 [ 13.372114] [] do_one_initcall+0x122/0x180 [ 13.378707] [] ? parse_args+0x1e8/0x320 [ 13.385016] [] kernel_init_freeable+0x1e1/0x26c [ 13.392100] [] ? do_early_param+0x88/0x88 [ 13.398596] [] ? rest_init+0xd0/0xd0 [ 13.404614] [] kernel_init+0xe/0x130 [ 13.410626] [] ret_from_fork+0x7c/0xb0 [ 13.416829] [] ? rest_init+0xd0/0xd0 [ 13.422842] Code: ec 99 00 85 c0 8b 05 53 05 a5 00 41 0f 45 d8 85 c0 0f 84 ff 00 00 00 8b 05 99 f9 7e 01 49 89 fe 41 89 f7 85 c0 0f 84 03 01 00 00 <49> 8b 06 be 01 00 00 00 48 3d c0 0e 01 82 0f 44 de 41 83 ff 01 [ 13.450191] RIP [] __lock_acquire+0x4d/0x12a0 [ 13.458598] RSP [ 13.462671] CR2: 0000000000000048 [ 13.466551] ---[ end trace c5bd26a37c81d760 ]--- Reviewed-by: Yijing Wang Signed-off-by: Jiang Liu --- drivers/iommu/intel-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c index 0ec49da..426095e 100644 --- a/drivers/iommu/intel-iommu.c +++ b/drivers/iommu/intel-iommu.c @@ -1289,9 +1289,9 @@ void free_dmar_iommu(struct intel_iommu *iommu) iommu_disable_translation(iommu); if (iommu->irq) { - irq_set_handler_data(iommu->irq, NULL); /* This will mask the irq */ free_irq(iommu->irq, iommu); + irq_set_handler_data(iommu->irq, NULL); destroy_irq(iommu->irq); }