public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
	Zwane Mwaikambo <zwane@arm.linux.org.uk>,
	"Theodore Ts'o" <tytso@mit.edu>,
	Randy Dunlap <rdunlap@xenotime.net>,
	Dave Jones <davej@redhat.com>,
	Chuck Wolber <chuckw@quantumlinux.com>,
	Chris Wedgwood <reviews@ml.cw.f00f.org>,
	Michael Krufky <mkrufky@linuxtv.org>,
	Chuck Ebbert <cebbert@redhat.com>,
	Domenico Andreoli <cavokz@gmail.com>,
	torvalds@linux-foundation.org, akpm@linux-foundation.org,
	alan@lxorguk.ukuu.org.uk, netdev@vger.kernel.org,
	Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Subject: [03/12] x86: Fix 32-bit x86 MSI-X allocation leakage
Date: Tue, 29 Apr 2008 11:49:29 -0700	[thread overview]
Message-ID: <20080429184929.GD24199@suse.de> (raw)
In-Reply-To: <20080429184911.GA24199@suse.de>

[-- Attachment #1: x86-fix-32-bit-x86-msi-x-allocation-leakage.patch --]
[-- Type: text/plain, Size: 1278 bytes --]

2.6.24-stable review patch.  If anyone has any objections, please let us
know.

------------------

From: PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com>

commit 9d9ad4b51d2b29b5bbeb4011f5e76f7538119cf9 upstream

This bug was introduced in the 2.6.24 i386/x86_64 tree merge, where
MSI-X vector allocation will eventually fail.  The cause is the new
bit array tracking used vectors is not getting cleared properly on
IRQ destruction on the 32-bit APIC code.

This can be seen easily using the ixgbe 10 GbE driver on multi-core
systems by simply loading and unloading the driver a few times.
Depending on the number of available vectors on the host system, the
MSI-X allocation will eventually fail, and the driver will only be
able to use legacy interrupts.

Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/x86/kernel/io_apic_32.c |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kernel/io_apic_32.c
+++ b/arch/x86/kernel/io_apic_32.c
@@ -2478,6 +2478,7 @@ void destroy_irq(unsigned int irq)
 	dynamic_irq_cleanup(irq);
 
 	spin_lock_irqsave(&vector_lock, flags);
+	clear_bit(irq_vector[irq], used_vectors);
 	irq_vector[irq] = 0;
 	spin_unlock_irqrestore(&vector_lock, flags);
 }

-- 

  parent reply	other threads:[~2008-04-29 18:51 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20080429184543.308594866@mini.kroah.org>
2008-04-29 18:49 ` [00/12] 2.6.24-stable review Greg KH
2008-04-29 18:49   ` [01/12] splice: use mapping_gfp_mask Greg KH
2008-04-29 18:49   ` [02/12] fix oops on rmmod capidrv Greg KH
2008-04-29 18:49   ` Greg KH [this message]
2008-04-29 18:49   ` [04/12] tehuti: check register size (CVE-2008-1675) Greg KH
2008-04-29 18:49   ` [05/12] tehuti: move ioctl perm check closer to function start (CVE-2008-1675) Greg KH
2008-04-29 18:49   ` [06/12] USB: gadget: queue usb USB_CDC_GET_ENCAPSULATED_RESPONSE message Greg KH
2008-04-29 18:49   ` [07/12] JFFS2: Fix free space leak with in-band cleanmarkers Greg KH
2008-04-29 18:49   ` [09/12] USB: remove broken usb-serial num_endpoints check Greg KH
2008-04-29 18:50   ` Greg KH
2008-04-29 18:50   ` [10/12] V4L: Fix VIDIOCGAP corruption in ivtv Greg KH
2008-04-29 18:50   ` [11/12] V4L: cx88: enable radio GPIO correctly Greg KH
2008-04-29 18:50   ` [12/12] ISDN: Do not validate ISDN net device address prior to interface-up Greg KH
2008-04-29 21:27   ` [00/12] 2.6.24-stable review Jörg-Volker Peetz
2008-04-29 22:45     ` Willy Tarreau
2008-04-30  3:21     ` Darren Salt
2008-05-01  3:39       ` [stable] " Greg KH
2008-05-02 15:24         ` Darren Salt
2008-05-08 17:27           ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20080429184929.GD24199@suse.de \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=cavokz@gmail.com \
    --cc=cebbert@redhat.com \
    --cc=chuckw@quantumlinux.com \
    --cc=davej@redhat.com \
    --cc=jmforbes@linuxtx.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mkrufky@linuxtv.org \
    --cc=netdev@vger.kernel.org \
    --cc=peter.p.waskiewicz.jr@intel.com \
    --cc=rdunlap@xenotime.net \
    --cc=reviews@ml.cw.f00f.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=tytso@mit.edu \
    --cc=zwane@arm.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox