3.16.7-ckt25 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Thomas Gleixner <tglx@xxxxxxxxxxxxx> commit e23b257c293ce4bcc8cabb2aa3097b6ed8a8261a upstream. setup_ioapic_dest() calls irqchip->irq_set_affinity() completely unprotected. That's wrong in several aspects: - it opens a race window where irq_set_affinity() can be interrupted and the irq chip left in unconsistent state. - it triggers a lockdep splat when we fix the vector race for 4.3+ because vector lock is taken with interrupts enabled. The proper calling convention is irq descriptor lock held and interrupts disabled. Reported-and-tested-by: Borislav Petkov <bp@xxxxxxxxx> Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx> Cc: Jiang Liu <jiang.liu@xxxxxxxxxxxxxxx> Cc: Jeremiah Mahler <jmmahler@xxxxxxxxx> Cc: andy.shevchenko@xxxxxxxxx Cc: Guenter Roeck <linux@xxxxxxxxxxxx> Cc: Joe Lawrence <joe.lawrence@xxxxxxxxxxx> Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1601140919420.3575@nanos Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx> [ luis: backported to 3.16: adjusted context ] Signed-off-by: Luis Henriques <luis.henriques@xxxxxxxxxxxxx> --- arch/x86/kernel/apic/io_apic.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c index 81e08eff05ee..9b0a93bfc800 100644 --- a/arch/x86/kernel/apic/io_apic.c +++ b/arch/x86/kernel/apic/io_apic.c @@ -3538,6 +3538,7 @@ void __init setup_ioapic_dest(void) { int pin, ioapic, irq, irq_entry; const struct cpumask *mask; + struct irq_desc *desc; struct irq_data *idata; if (skip_ioapic_setup == 1) @@ -3553,7 +3554,9 @@ void __init setup_ioapic_dest(void) if ((ioapic > 0) && (irq > 16)) continue; - idata = irq_get_irq_data(irq); + desc = irq_to_desc(irq); + raw_spin_lock_irq(&desc->lock); + idata = irq_desc_get_irq_data(desc); /* * Honour affinities which have been set in early boot @@ -3564,6 +3567,7 @@ void __init setup_ioapic_dest(void) mask = apic->target_cpus(); x86_io_apic_ops.set_affinity(idata, mask, false); + raw_spin_unlock_irq(&desc->lock); } } -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html