From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg KH Subject: [36/37] x86: Fix 32-bit x86 MSI-X allocation leakage Date: Tue, 29 Apr 2008 10:19:23 -0700 Message-ID: <20080429171923.GK14724@suse.de> References: <20080429171222.073929148@mini.kroah.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Justin Forbes , Zwane Mwaikambo , Theodore Ts'o , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, netdev@vger.kernel.org, Peter P Waskiewicz Jr To: linux-kernel@vger.kernel.org, stable@kernel.org Return-path: Received: from cantor.suse.de ([195.135.220.2]:52706 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758384AbYD2RWY (ORCPT ); Tue, 29 Apr 2008 13:22:24 -0400 Content-Disposition: inline; filename="x86-fix-32-bit-x86-msi-x-allocation-leakage.patch" In-Reply-To: <20080429171730.GA14724@suse.de> Sender: netdev-owner@vger.kernel.org List-ID: 2.6.25-stable review patch. If anyone has any objections, please let us know. ------------------ From: PJ Waskiewicz commit 9d9ad4b51d2b29b5bbeb4011f5e76f7538119cf9 upstream This bug was introduced in the 2.6.24 i386/x86_64 tree merge, where MSI-X vector allocation will eventually fail. The cause is the new bit array tracking used vectors is not getting cleared properly on IRQ destruction on the 32-bit APIC code. This can be seen easily using the ixgbe 10 GbE driver on multi-core systems by simply loading and unloading the driver a few times. Depending on the number of available vectors on the host system, the MSI-X allocation will eventually fail, and the driver will only be able to use legacy interrupts. Signed-off-by: Peter P Waskiewicz Jr Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- arch/x86/kernel/io_apic_32.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/x86/kernel/io_apic_32.c +++ b/arch/x86/kernel/io_apic_32.c @@ -2477,6 +2477,7 @@ void destroy_irq(unsigned int irq) dynamic_irq_cleanup(irq); spin_lock_irqsave(&vector_lock, flags); + clear_bit(irq_vector[irq], used_vectors); irq_vector[irq] = 0; spin_unlock_irqrestore(&vector_lock, flags); } --