LKML Archive on lore.kernel.org help / color / mirror / Atom feed
From: Boris Ostrovsky <firstname.lastname@example.org> To: "Roger Pau Monné" <email@example.com>, "Ben Hutchings" <firstname.lastname@example.org> Cc: Greg Kroah-Hartman <email@example.com>, LKML <firstname.lastname@example.org>, stable <email@example.com>, Hooman Mirhadi <firstname.lastname@example.org>, Amit Shah <email@example.com>, Juergen Gross <firstname.lastname@example.org>, Sasha Levin <email@example.com> Subject: Re: [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs Date: Thu, 14 Jun 2018 08:51:39 -0400 [thread overview] Message-ID: <firstname.lastname@example.org> (raw) In-Reply-To: <email@example.com> On 06/14/2018 04:21 AM, Roger Pau Monné wrote: > On Wed, Jun 13, 2018 at 07:48:50PM +0100, Ben Hutchings wrote: >> On Wed, 2018-02-28 at 09:19 +0000, Roger Pau Monne wrote: >>> From: Roger Pau Monne <firstname.lastname@example.org> >>> >>> [ Upstream commit 910f8befdf5bccf25287d9f1743e3e546bcb7ce0 ] >>> >>> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is >>> wrong. First of all there's an off-by-one in the cleanup loop, which >>> can lead to unbinding wrong IRQs. >>> >>> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers. >>> >>> Note that there's no need to differentiate between bound and unbound >>> IRQs when freeing them, __unbind_from_irq will deal with both of them >>> correctly. >> It appears to me that it is safe to call __unbind_from_irq() after >> xen_irq_info_common_setup() fails, but *not* if the latter hasn't been >> called at all. In that case the IRQ type will still be set to >> IRQT_UNBOUND and this will trigger the BUG_ON() in __unbind_from_irq(). >> >> [...] >>> --- a/drivers/xen/events/events_base.c >>> +++ b/drivers/xen/events/events_base.c >>> @@ -764,8 +764,8 @@ out: >>> mutex_unlock(&irq_mapping_update_lock); >>> return irq; >>> error_irq: >>> - for (; i >= 0; i--) >>> - __unbind_from_irq(irq + i); >>> + while (nvec--) >>> + __unbind_from_irq(irq + nvec); >> If nvec > 1, and xen_irq_info_pirq_setup() fails for i != nvec - 1, >> then we reach here without having called xen_irq_info_common_setup() >> for all these IRQs. >> >> In that case, I think we will still want to call xen_free_irq() for all >> IRQs. So maybe the fix would be to remove the BUG_ON() in >> __unbind_from_irq()? > I think your analysis is right, and I agree that removing the BUG_ON > from __unbind_from_irq seems like the right solution. > > I can't see any issues from calling xen_free_irq with type == > IRQT_UNBOUND, but I've already attempted to fix this once and failed, > so I would like to get second opinions. Also I'm not sure of the > reason behind that BUG_ON. I don't see a reason for the BUG_ON either. -boris
prev parent reply other threads:[~2018-06-14 12:52 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top [not found] <email@example.com> 2018-06-13 18:48 ` [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs Ben Hutchings 2018-06-14 8:21 ` Roger Pau Monné 2018-06-14 12:51 ` Boris Ostrovsky [this message]
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).