Re: irq_desc_lock_class is held when it is freed

[Yinghai Lu <yinghai@kernel.org>]

Eric Paris wrote:
> On Sat, 2009-01-31 at 14:50 -0800, Yinghai Lu wrote:
>> Eric Paris wrote:
>>> I have an hp dl785g5 which is unable to successfully run
>>> 2.6.29-0.66.rc3.fc11.x86_64 or 2.6.29-rc2-next-20090126.  During bootup
>>> (early in userspace daemons starting) I get the below BUG, which quickly
>>> renders the machine dead.  I assume it is because sparse_irq_lock never
>>> gets released when the BUG kills that task.  But maybe it dies for some
>>> other reason, but the machine is dead, gotta hit the vitual power
>>> button.
>>>
>>> setting CONFIG_NUMA_MIGRATE_IRQ_DESC=n allowed me to successfully boot
>>> the linux-next kernel.  2.6.28 booted and worked fine (although it
>>> doesn't have this config option, so that isn't surprising.)
>>>
>>> attached you will find the linux-next config and dmesg output from the
>>> machine in question when booted using linux-next WITHOUT the
>>> MIGRATE_IRQ_DESC.  The only difference between the working and broken
>>> config is if CONFIG_NUMA_MIGRATE_IRQ_DESC is set or not.
>>>
>>> Please if there is anything I can collect, test, or do, don't hesitate
>>> to let me know.
>>>
>> it seems there is some merge problem... also there could be another problem...
>>
>> please check
>>
>> diff --git a/arch/x86/kernel/io_apic.c b/arch/x86/kernel/io_apic.c
>> index 6c02c25..610ce0a 100644
>> --- a/arch/x86/kernel/io_apic.c
>> +++ b/arch/x86/kernel/io_apic.c
>> @@ -2511,14 +2511,15 @@ static void irq_complete_move(struct irq_desc **descp)
>>  
>>  	vector = ~get_irq_regs()->orig_ax;
>>  	me = smp_processor_id();
>> +
>> +	if (vector == cfg->vector && cpumask_test_cpu(me, cfg->domain)) {
>>  #ifdef CONFIG_NUMA_MIGRATE_IRQ_DESC
>>  		*descp = desc = move_irq_desc(desc, me);
>>  		/* get the new one */
>>  		cfg = desc->chip_data;
>>  #endif
>> -
>> -	if (vector == cfg->vector && cpumask_test_cpu(me, cfg->domain))
>>  		send_cleanup_vector(cfg);
>> +	}
>>  }
>>  #else
>>  static inline void irq_complete_move(struct irq_desc **descp) {}
> 
> Looks like I got the same thing.....
> 

and

[PATCH] x86: fix lock status with numa_migrate_irq_desc

Impact: make the lock state consistent

adjust lock sequence...

Reported-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>

---
 kernel/irq/numa_migrate.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Index: linux-2.6/kernel/irq/numa_migrate.c
===================================================================
--- linux-2.6.orig/kernel/irq/numa_migrate.c
+++ linux-2.6/kernel/irq/numa_migrate.c
@@ -78,7 +78,7 @@ static struct irq_desc *__real_move_irq_
 	desc = irq_desc_ptrs[irq];
 
 	if (desc && old_desc != desc)
-			goto out_unlock;
+		goto out_unlock;
 
 	node = cpu_to_node(cpu);
 	desc = kzalloc_node(sizeof(*desc), GFP_ATOMIC, node);
@@ -97,10 +97,14 @@ static struct irq_desc *__real_move_irq_
 	}
 
 	irq_desc_ptrs[irq] = desc;
+	spin_unlock_irqrestore(&sparse_irq_lock, flags);
 
 	/* free the old one */
 	free_one_irq_desc(old_desc, desc);
+	spin_unlock(&old_desc->lock);
 	kfree(old_desc);
+	spin_lock(&desc->lock);
+	return desc;
 
 out_unlock:
 	spin_unlock_irqrestore(&sparse_irq_lock, flags);