Messages in this thread | | | Date | Thu, 13 Aug 2009 22:24:56 +0200 (CEST) | From | Thomas Gleixner <> | Subject | Re: [GIT pull] genirq fixes for 2.6.31 |
| |
On Thu, 13 Aug 2009, Linus Torvalds wrote: > On Thu, 13 Aug 2009, Thomas Gleixner wrote: > > What guarantees that the compiler does not dereference action->thread > > twice and the action->thread = NULL; operation happens between the > > check and the wake_up_process() call? I might be paranoid, but ... > > Aren't we holding the lock here?
No, we don't. The lock is dropped before handle_IRQ_event() is called.
> And if we are _not_ holding the lock, then it's racy anyway, and the right > fix is the other one I suggested: > > > > Or, alternatively, just move all the "clear action->thread" in free_irq() > > > to after having done the "synchronize_irq()" thing, and then - afaik - > > > you'll not need that test at all, because you're guaranteed that as long > > > as you're in an interrupt handler, the thing shouldn't be cleared. > > > > Right, I looked at that as well, but we need to do it different than > > just calling synchronize_irq(), as we need to keep desc->lock after we > > established that no interrupt is in progress. Otherwise we can run > > into the same problem which we have right now. Patch below. > > But we already _do_ call synchronize_irq(). > > And no, we'd better not be running into the same problem, becaue dang it, > if we do, then 'action' itself is unreliable (since we'll be doing a > 'kfree()' in it in free_irq())
action->thread is the thing which became unreliable due to setting it to NULL. Yes, I did not think about the fact that we can remove the action while the interrupt is in progress on another CPU. So setting action->thread to NULL _before_ calling synchronize_irq() is the cause for the oops which has been reported.
> IOW, why not just make the patch do something like the appended? > > NOTE! This is UNTESTED. And I also - on purpose - removed the "set > action->thread to NULL", because we're going to free 'action', so if > anything depends on it, it's already buggy.
Works fine with my test case.
> What am I missing?
Nothing, as far as I can tell.
Acked-by-me.
tglx
> > --- > kernel/irq/manage.c | 17 ++++++++--------- > 1 files changed, 8 insertions(+), 9 deletions(-) > > diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c > index 61c679d..0747f22 100644 > --- a/kernel/irq/manage.c > +++ b/kernel/irq/manage.c > @@ -809,9 +809,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id) > desc->chip->disable(irq); > } > > - irqthread = action->thread; > - action->thread = NULL; > - > spin_unlock_irqrestore(&desc->lock, flags); > > unregister_handler_proc(irq, action); > @@ -819,12 +816,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id) > /* Make sure it's not being used on another CPU: */ > synchronize_irq(irq); > > - if (irqthread) { > - if (!test_bit(IRQTF_DIED, &action->thread_flags)) > - kthread_stop(irqthread); > - put_task_struct(irqthread); > - } > - > #ifdef CONFIG_DEBUG_SHIRQ > /* > * It's a shared IRQ -- the driver ought to be prepared for an IRQ > @@ -840,6 +831,14 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id) > local_irq_restore(flags); > } > #endif > + > + irqthread = action->thread; > + if (irqthread) { > + if (!test_bit(IRQTF_DIED, &action->thread_flags)) > + kthread_stop(irqthread); > + put_task_struct(irqthread); > + } > + > return action; > } > >
| |