Re: [PATCH] iommu/vt-d: fix race between free_irte() and get_irte()

Joerg Roedel
2014-07-23T15:10:46Z

On Wed, Jul 23, 2014 at 08:49:17AM -0600, Greg Edwards wrote:
> On Wed, Jul 23, 2014 at 04:40:24PM +0200, Joerg Roedel wrote:
> > On Tue, Jul 22, 2014 at 08:27:19AM -0600, Greg Edwards wrote:
> >> get_irte() can race with free_irte() and dereference a NULL iommu
> >> pointer.
> >
> > Have you seen any real occurance of this race? Get_irte is called in the
> > set_affinity path, how can that race with the irq being freed?
>
> Yes, that's how we hit it. A process was setting the CPU affinity while
> QEMU was releasing the IRQ. We have a CI stress test that turned this
> up.

Can you update the commit message with the details of how this race can
be triggered, ideally with a stack-trace of a real crash you triggered
because of this issue?

Thanks,

Joerg