[Xen-devel] [PATCH 1/2] xen: Clear IRQ_GUEST bit from irq_desc status if its action is NULL

[Igor Mammedov <imammedo@xxxxxxxxxx>]

    On a system with Intel C600 series Patsburg SAS controller
    if following commands are executed:

      rmmod isci
      modprobe isci

    the host will crash in pirq_guest_bind in attempt to dereference
    NULL 'action' pointer.

    This is caused by isci driver which does not cleanup irq properly,
    removing device first and then os tries to unbind its irqs afterwards.

    c/s 20093 and 20844 fixed host crashes when removing isci module.

    However in dynamic_irq_cleanup 'action' field of irq_desc is set to
    NULL but IRQ_GUEST flag in 'status' field is not cleared. So on next
    attempt to bind pirq (modprobe isci) in pirq_guest_bind with IRQ_GUEST
    flag set, the branch

      if ( !(desc->status & IRQ_GUEST) )

    is skipped and host ends up with dereferencing NULL pointer 'action'.

    __pirq_guest_unbind is the only place where IRQ_GUEST flag is cleared,
    lets keep it this way. Besides it is not safe to clear IRQ_GUEST flag
    in dynamic_irq_cleanup, because we can later hit
       BUG_ON(!(desc->status & IRQ_GUEST));
    in pirq_guest_unbind -> __pirq_guest_unbind

Signed-off-by: Igor Mammedov <imammedo@xxxxxxxxxx>
Reviewed-by: Jan Beulich <JBeulich@xxxxxxxx>

diff -r 0312575dc35e -r 2049f7ca3177 xen/arch/x86/irq.c
--- a/xen/arch/x86/irq.c        Thu Sep 08 15:13:06 2011 +0100
+++ b/xen/arch/x86/irq.c        Tue Sep 13 14:44:59 2011 +0200
@@ -1472,6 +1472,7 @@ static irq_guest_action_t *__pirq_guest_
 
     if ( unlikely(action == NULL) )
     {
+        desc->status &= ~IRQ_GUEST;
         dprintk(XENLOG_G_WARNING, "dom%d: pirq %d: desc->action is NULL!\n",
                 d->domain_id, pirq->pirq);
         return NULL;
@@ -1599,6 +1600,7 @@ static int pirq_guest_force_unbind(struc
     action = (irq_guest_action_t *)desc->action;
     if ( unlikely(action == NULL) )
     {
+        desc->status &= ~IRQ_GUEST;
         dprintk(XENLOG_G_WARNING, "dom%d: pirq %d: desc->action is NULL!\n",
             d->domain_id, pirq->pirq);
         goto out;

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel