From: Luis Henriques <luis.henriques@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
Luis Henriques <luis.henriques@canonical.com>
Subject: [PATCH 023/118] xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU online/offline
Date: Tue, 7 May 2013 14:37:49 +0100 [thread overview]
Message-ID: <1367933964-1564-24-git-send-email-luis.henriques@canonical.com> (raw)
In-Reply-To: <1367933964-1564-1-git-send-email-luis.henriques@canonical.com>
3.5.7.12 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 66ff0fe9e7bda8aec99985b24daad03652f7304e upstream.
While we don't use the spinlock interrupt line (see for details
commit f10cd522c5fbfec9ae3cc01967868c9c2401ed23 -
xen: disable PV spinlocks on HVM) - we should still do the proper
init / deinit sequence. We did not do that correctly and for the
CPU init for PVHVM guest we would allocate an interrupt line - but
failed to deallocate the old interrupt line.
This resulted in leakage of an irq_desc but more importantly this splat
as we online an offlined CPU:
genirq: Flags mismatch irq 71. 0002cc20 (spinlock1) vs. 0002cc20 (spinlock1)
Pid: 2542, comm: init.late Not tainted 3.9.0-rc6upstream #1
Call Trace:
[<ffffffff811156de>] __setup_irq+0x23e/0x4a0
[<ffffffff81194191>] ? kmem_cache_alloc_trace+0x221/0x250
[<ffffffff811161bb>] request_threaded_irq+0xfb/0x160
[<ffffffff8104c6f0>] ? xen_spin_trylock+0x20/0x20
[<ffffffff813a8423>] bind_ipi_to_irqhandler+0xa3/0x160
[<ffffffff81303758>] ? kasprintf+0x38/0x40
[<ffffffff8104c6f0>] ? xen_spin_trylock+0x20/0x20
[<ffffffff810cad35>] ? update_max_interval+0x15/0x40
[<ffffffff816605db>] xen_init_lock_cpu+0x3c/0x78
[<ffffffff81660029>] xen_hvm_cpu_notify+0x29/0x33
[<ffffffff81676bdd>] notifier_call_chain+0x4d/0x70
[<ffffffff810bb2a9>] __raw_notifier_call_chain+0x9/0x10
[<ffffffff8109402b>] __cpu_notify+0x1b/0x30
[<ffffffff8166834a>] _cpu_up+0xa0/0x14b
[<ffffffff816684ce>] cpu_up+0xd9/0xec
[<ffffffff8165f754>] store_online+0x94/0xd0
[<ffffffff8141d15b>] dev_attr_store+0x1b/0x20
[<ffffffff81218f44>] sysfs_write_file+0xf4/0x170
[<ffffffff811a2864>] vfs_write+0xb4/0x130
[<ffffffff811a302a>] sys_write+0x5a/0xa0
[<ffffffff8167ada9>] system_call_fastpath+0x16/0x1b
cpu 1 spinlock event irq -16
smpboot: Booting Node 0 Processor 1 APIC 0x2
And if one looks at the /proc/interrupts right after
offlining (CPU1):
70: 0 0 xen-percpu-ipi spinlock0
71: 0 0 xen-percpu-ipi spinlock1
77: 0 0 xen-percpu-ipi spinlock2
There is the oddity of the 'spinlock1' still being present.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/xen/smp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 150178e..caeff44 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -669,6 +669,7 @@ static void xen_hvm_cpu_die(unsigned int cpu)
unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL);
unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL);
unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL);
+ xen_uninit_lock_cpu(cpu);
xen_teardown_timer(cpu);
native_cpu_die(cpu);
}
--
1.8.1.2
next prev parent reply other threads:[~2013-05-07 13:40 UTC|newest]
Thread overview: 119+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-07 13:37 [ 3.5.y.z extended stable ] Linux 3.5.7.12 stable review Luis Henriques
2013-05-07 13:37 ` [PATCH 001/118] ath9k_htc: accept 1.x firmware newer than 1.3 Luis Henriques
2013-05-07 13:37 ` [PATCH 002/118] ssb: implement spurious tone avoidance Luis Henriques
2013-05-07 13:37 ` [PATCH 003/118] can: mcp251x: add missing IRQF_ONESHOT to request_threaded_irq Luis Henriques
2013-05-07 13:37 ` [PATCH 004/118] can: sja1000: fix handling on dt properties on little endian systems Luis Henriques
2013-05-07 13:37 ` [PATCH 005/118] ath9k_hw: change AR9580 initvals to fix a stability issue Luis Henriques
2013-05-07 13:37 ` [PATCH 006/118] ARM: 7696/1: Fix kexec by setting outer_cache.inv_all for Feroceon Luis Henriques
2013-05-07 13:37 ` [PATCH 007/118] ARM: 7698/1: perf: fix group validation when using enable_on_exec Luis Henriques
2013-05-07 13:37 ` [PATCH 008/118] hugetlbfs: add swap entry check in follow_hugetlb_page() Luis Henriques
2013-05-07 13:37 ` [PATCH 009/118] kernel/signal.c: stop info leak via the tkill and the tgkill syscalls Luis Henriques
2013-05-07 13:37 ` [PATCH 010/118] hfsplus: fix potential overflow in hfsplus_file_truncate() Luis Henriques
2013-05-07 13:37 ` [PATCH 011/118] sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s Luis Henriques
2013-05-07 13:37 ` [PATCH 012/118] crypto: algif - suppress sending source address information in recvmsg Luis Henriques
2013-05-07 13:37 ` [PATCH 013/118] perf: Treat attr.config as u64 in perf_swevent_init() Luis Henriques
2013-05-07 13:37 ` [PATCH 014/118] perf/x86: Fix offcore_rsp valid mask for SNB/IVB Luis Henriques
2013-05-07 13:37 ` [PATCH 015/118] vm: add vm_iomap_memory() helper function Luis Henriques
2013-05-07 13:37 ` [PATCH 016/118] vm: convert HPET mmap to vm_iomap_memory() helper Luis Henriques
2013-05-07 13:37 ` [PATCH 017/118] vm: convert fb_mmap " Luis Henriques
2013-05-07 13:37 ` [PATCH 018/118] vm: convert snd_pcm_lib_mmap_iomem() " Luis Henriques
2013-05-07 13:37 ` [PATCH 019/118] vm: convert mtdchar mmap " Luis Henriques
2013-05-07 13:37 ` [PATCH 020/118] regulator: fixed regulator_bulk_enable unwinding code Luis Henriques
2013-05-07 13:37 ` [PATCH 021/118] perf: Fix error return code Luis Henriques
2013-05-07 13:37 ` [PATCH 022/118] xen/smp: Fix leakage of timer interrupt line for every CPU online/offline Luis Henriques
2013-05-07 13:37 ` Luis Henriques [this message]
2013-05-07 13:37 ` [PATCH 024/118] xen/time: Fix kasprintf splat when allocating timer%d IRQ line Luis Henriques
2013-05-07 13:37 ` [PATCH 025/118] s390/memory hotplug: prevent offline of active memory increments Luis Henriques
2013-05-07 13:37 ` [PATCH 026/118] aio: fix possible invalid memory access when DEBUG is enabled Luis Henriques
2013-05-07 13:37 ` [PATCH 027/118] TTY: do not update atime/mtime on read/write Luis Henriques
2013-05-07 13:37 ` [PATCH 028/118] TTY: fix atime/mtime regression Luis Henriques
2013-05-07 13:37 ` [PATCH 029/118] atm: update msg_namelen in vcc_recvmsg() Luis Henriques
2013-05-07 13:37 ` [PATCH 030/118] ax25: fix info leak via msg_name in ax25_recvmsg() Luis Henriques
2013-05-07 13:37 ` [PATCH 031/118] Bluetooth: fix possible info leak in bt_sock_recvmsg() Luis Henriques
2013-05-07 13:37 ` [PATCH 032/118] Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg() Luis Henriques
2013-05-07 13:37 ` [PATCH 033/118] caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg() Luis Henriques
2013-05-07 13:38 ` [PATCH 034/118] irda: Fix missing msg_namelen update in irda_recvmsg_dgram() Luis Henriques
2013-05-07 13:38 ` [PATCH 035/118] iucv: Fix missing msg_namelen update in iucv_sock_recvmsg() Luis Henriques
2013-05-07 13:38 ` [PATCH 036/118] llc: Fix missing msg_namelen update in llc_ui_recvmsg() Luis Henriques
2013-05-07 13:38 ` [PATCH 037/118] netrom: fix info leak via msg_name in nr_recvmsg() Luis Henriques
2013-05-07 13:38 ` [PATCH 038/118] netrom: fix invalid use of sizeof " Luis Henriques
2013-05-07 13:38 ` [PATCH 039/118] NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg() Luis Henriques
2013-05-07 13:38 ` [PATCH 040/118] rose: fix info leak via msg_name in rose_recvmsg() Luis Henriques
2013-05-07 13:38 ` [PATCH 041/118] tipc: fix info leaks via msg_name in recv_msg/recv_stream Luis Henriques
2013-05-07 13:38 ` [PATCH 042/118] cbq: incorrect processing of high limits Luis Henriques
2013-05-07 13:38 ` [PATCH 043/118] net IPv6 : Fix broken IPv6 routing table after loopback down-up Luis Henriques
2013-05-07 13:38 ` [PATCH 044/118] net: count hw_addr syncs so that unsync works properly Luis Henriques
2013-05-07 13:38 ` [PATCH 045/118] atl1e: limit gso segment size to prevent generation of wrong ip length fields Luis Henriques
2013-05-07 13:38 ` [PATCH 046/118] bonding: fix bonding_masters race condition in bond unloading Luis Henriques
2013-05-07 13:38 ` [PATCH 047/118] bonding: IFF_BONDING is not stripped on enslave failure Luis Henriques
2013-05-07 13:38 ` [PATCH 048/118] af_unix: If we don't care about credentials coallesce all messages Luis Henriques
2013-05-07 13:38 ` [PATCH 049/118] netfilter: don't reset nf_trace in nf_reset() Luis Henriques
2013-05-07 13:38 ` [PATCH 050/118] rtnetlink: Call nlmsg_parse() with correct header length Luis Henriques
2013-05-07 13:38 ` [PATCH 051/118] tcp: incoming connections might use wrong route under synflood Luis Henriques
2013-05-07 13:38 ` [PATCH 052/118] tcp: Reallocate headroom if it would overflow csum_start Luis Henriques
2013-05-07 13:38 ` [PATCH 053/118] esp4: fix error return code in esp_output() Luis Henriques
2013-05-07 13:38 ` [PATCH 054/118] net: sctp: sctp_auth_key_put: use kzfree instead of kfree Luis Henriques
2013-05-07 13:38 ` [PATCH 055/118] tcp: call tcp_replace_ts_recent() from tcp_ack() Luis Henriques
2013-05-07 13:38 ` [PATCH 056/118] net: rate-limit warn-bad-offload splats Luis Henriques
2013-05-07 13:38 ` [PATCH 057/118] net: fix incorrect credentials passing Luis Henriques
2013-05-07 13:38 ` [PATCH 058/118] net: drop dst before queueing fragments Luis Henriques
2013-05-07 13:38 ` [PATCH 059/118] sparc64: Fix race in TLB batch processing Luis Henriques
2013-05-07 13:38 ` [PATCH 060/118] l2tp: fix info leak in l2tp_ip6_recvmsg() Luis Henriques
2013-05-07 13:38 ` [PATCH 061/118] tracing: Use stack of calling function for stack tracer Luis Henriques
2013-05-07 13:38 ` [PATCH 062/118] tracing: Fix stack tracer with fentry use Luis Henriques
2013-05-07 13:38 ` [PATCH 063/118] tracing: Remove most or all of stack tracer stack size from stack_max_size Luis Henriques
2013-05-07 13:38 ` [PATCH 064/118] tracing: Fix ftrace_dump() Luis Henriques
2013-05-07 13:38 ` [PATCH 065/118] Wrong asm register contraints in the futex implementation Luis Henriques
2013-05-07 13:38 ` [PATCH 066/118] Wrong asm register contraints in the kvm implementation Luis Henriques
2013-05-07 13:38 ` [PATCH 067/118] cgroup: fix an off-by-one bug which may trigger BUG_ON() Luis Henriques
2013-05-07 13:38 ` [PATCH 068/118] PCI / ACPI: Don't query OSC support with all possible controls Luis Henriques
2013-05-07 13:38 ` [PATCH 069/118] Fix initialization of CMCI/CMCP interrupts Luis Henriques
2013-05-07 13:38 ` [PATCH 070/118] sysfs: fix use after free in case of concurrent read/write and readdir Luis Henriques
2013-05-07 13:38 ` [PATCH 071/118] usb/misc/appledisplay: Add 24" LED Cinema display Luis Henriques
2013-05-07 13:38 ` [PATCH 072/118] ext4/jbd2: don't wait (forever) for stale tid caused by wraparound Luis Henriques
2013-05-07 13:38 ` [PATCH 073/118] jbd2: fix race between jbd2_journal_remove_checkpoint and ->j_commit_callback Luis Henriques
2013-05-07 13:38 ` [PATCH 074/118] ext4: fix journal callback list traversal Luis Henriques
2013-05-07 13:38 ` [PATCH 075/118] usb: chipidea: udc: fix memory access of shared memory on armv5 machines Luis Henriques
2013-05-07 13:38 ` [PATCH 076/118] NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_open_delegation_recall Luis Henriques
2013-05-07 13:38 ` [PATCH 077/118] usb: chipidea: udc: fix memory leak in _ep_nuke Luis Henriques
2013-05-07 13:38 ` [PATCH 078/118] USB: add ftdi_sio USB ID for GDM Boost V1.x Luis Henriques
2013-05-07 13:38 ` [PATCH 079/118] hrtimer: Add expiry time overflow check in hrtimer_interrupt Luis Henriques
2013-05-07 13:38 ` [PATCH 080/118] hrtimer: Fix ktime_add_ns() overflow on 32bit architectures Luis Henriques
2013-05-07 13:38 ` [PATCH 081/118] ARM: omap3: cpuidle: enable time keeping Luis Henriques
2013-05-07 13:38 ` [PATCH 082/118] tracing: Fix off-by-one on allocating stat->pages Luis Henriques
2013-05-07 13:38 ` [PATCH 083/118] USB: option: add a D-Link DWM-156 variant Luis Henriques
2013-05-07 13:38 ` [PATCH 084/118] ext4: fix big-endian bug in metadata checksum calculations Luis Henriques
2013-05-07 13:38 ` [PATCH 085/118] tracing: Reset ftrace_graph_filter_enabled if count is zero Luis Henriques
2013-05-07 13:38 ` [PATCH 086/118] tracing: Check return value of tracing_init_dentry() Luis Henriques
2013-05-07 13:38 ` [PATCH 087/118] serial_core.c: add put_device() after device_find_child() Luis Henriques
2013-05-07 13:38 ` [PATCH 088/118] PCI/PM: Fix fallback to PCI_D0 in pci_platform_power_transition() Luis Henriques
2013-05-07 13:38 ` [PATCH 089/118] wireless: regulatory: fix channel disabling race condition Luis Henriques
2013-05-07 13:38 ` [PATCH 090/118] usbfs: Always allow ctrl requests with USB_RECIP_ENDPOINT on the ctrl ep Luis Henriques
2013-05-07 13:38 ` [PATCH 091/118] iwlwifi: fix freeing uninitialized pointer Luis Henriques
2013-05-07 13:38 ` [PATCH 092/118] iwlwifi: dvm: don't send zeroed LQ cmd Luis Henriques
2013-05-07 13:38 ` [PATCH 093/118] LOCKD: Ensure that nlmclnt_block resets block->b_status after a server reboot Luis Henriques
2013-05-07 13:39 ` [PATCH 094/118] ext4: fix online resizing for ext3-compat file systems Luis Henriques
2013-05-07 13:39 ` [PATCH 095/118] ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG Luis Henriques
2013-05-07 13:39 ` [PATCH 096/118] rt2x00: Fix transmit power troubles on some Ralink RT30xx cards Luis Henriques
2013-05-07 13:39 ` [PATCH 097/118] USB: ftdi_sio: correct ST Micro Connect Lite PIDs Luis Henriques
2013-05-07 13:39 ` [PATCH 098/118] USB: serial: option: Added support Olivetti Olicard 145 Luis Henriques
2013-05-07 13:39 ` [PATCH 099/118] usb-storage: CY7C68300A chips do not support Cypress ATACB Luis Henriques
2013-05-07 13:39 ` [PATCH 100/118] USB: ftdi_sio: enable two UART ports on ST Microconnect Lite Luis Henriques
2013-05-07 13:39 ` [PATCH 101/118] gianfar: do not advertise any alarm capability Luis Henriques
2013-05-07 13:39 ` [PATCH 102/118] clockevents: Set dummy handler on CPU_DEAD shutdown Luis Henriques
2013-05-07 13:39 ` [PATCH 103/118] ixgbe: fix EICR write in ixgbe_msix_other Luis Henriques
2013-05-07 13:39 ` [PATCH 104/118] mwifiex: Use pci_release_region() instead of a pci_release_regions() Luis Henriques
2013-05-07 13:39 ` [PATCH 105/118] mwifiex: Call pci_release_region after calling pci_disable_device Luis Henriques
2013-05-07 13:39 ` [PATCH 106/118] fs/fscache/stats.c: fix memory leak Luis Henriques
2013-05-07 13:39 ` [PATCH 107/118] mm: allow arch code to control the user page table ceiling Luis Henriques
2013-05-07 13:39 ` [PATCH 108/118] arm: set the page table freeing ceiling to TASK_SIZE Luis Henriques
2013-05-07 13:39 ` [PATCH 109/118] drivers/rtc/rtc-cmos.c: don't disable hpet emulation on suspend Luis Henriques
2013-05-07 13:39 ` [PATCH 110/118] drivers/rtc/rtc-at91rm9200.c: fix missing iounmap Luis Henriques
2013-05-07 13:39 ` [PATCH 111/118] md: bad block list should default to disabled Luis Henriques
2013-05-07 13:39 ` [PATCH 112/118] inotify: invalid mask should return a error number but not set it Luis Henriques
2013-05-07 13:39 ` [PATCH 113/118] fs/dcache.c: add cond_resched() to shrink_dcache_parent() Luis Henriques
2013-05-07 13:39 ` [PATCH 114/118] exec: do not abuse ->cred_guard_mutex in threadgroup_lock() Luis Henriques
2013-05-07 13:39 ` [PATCH 115/118] tty: fix up atime/mtime mess, take three Luis Henriques
2013-05-07 13:39 ` [PATCH 116/118] ipc: sysv shared memory limited to 8TiB Luis Henriques
2013-05-07 13:39 ` [PATCH 117/118] Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for scanline waits" Luis Henriques
2013-05-07 13:39 ` [PATCH 118/118] ARM: 7699/1: sched_clock: Add more notrace to prevent recursion Luis Henriques
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1367933964-1564-24-git-send-email-luis.henriques@canonical.com \
--to=luis.henriques@canonical.com \
--cc=kernel-team@lists.ubuntu.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®