xen/events: don't bind non-percpu VIRQs with percpu chip
authorDavid Vrabel <david.vrabel@citrix.com>
Tue, 19 May 2015 17:40:49 +0000 (18:40 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 6 Aug 2015 23:32:12 +0000 (00:32 +0100)
commit14204ab641926fca1fed8afb61dcf8f4dc382166
tree3cdb7fd0ea0eefb20464f47bb1d2c88fcfac7354
parentfd6b72574fcdaee123768804d8f1ac28c2a5b3de
xen/events: don't bind non-percpu VIRQs with percpu chip

commit 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a upstream.

A non-percpu VIRQ (e.g., VIRQ_CONSOLE) may be freed on a different
VCPU than it is bound to.  This can result in a race between
handle_percpu_irq() and removing the action in __free_irq() because
handle_percpu_irq() does not take desc->lock.  The interrupt handler
sees a NULL action and oopses.

Only use the percpu chip/handler for per-CPU VIRQs (like VIRQ_TIMER).

  # cat /proc/interrupts | grep virq
   40:      87246          0  xen-percpu-virq      timer0
   44:          0          0  xen-percpu-virq      debug0
   47:          0      20995  xen-percpu-virq      timer1
   51:          0          0  xen-percpu-virq      debug1
   69:          0          0   xen-dyn-virq      xen-pcpu
   74:          0          0   xen-dyn-virq      mce
   75:         29          0   xen-dyn-virq      hvc_console

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
[bwh: Backported to 3.2: adjust filename, context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/tty/hvc/hvc_xen.c
drivers/xen/events.c
include/xen/events.h