)]}'
{
  "commit": "ced5b697a76d325e7a7ac7d382dbbb632c765093",
  "tree": "1a0a56d4415afcd16d034aa3bc5c0a6ba06c8a52",
  "parents": [
    "e28cab42f384745c8a947a9ccd51e4aae52f5d51"
  ],
  "author": {
    "name": "Brandon Phiilps",
    "email": "bphilips@suse.de",
    "time": "Wed Feb 10 01:20:06 2010 -0800"
  },
  "committer": {
    "name": "H. Peter Anvin",
    "email": "hpa@zytor.com",
    "time": "Wed Feb 10 14:27:28 2010 -0800"
  },
  "message": "x86: Avoid race condition in pci_enable_msix()\n\nKeep chip_data in create_irq_nr and destroy_irq.\n\nWhen two drivers are setting up MSI-X at the same time via\npci_enable_msix() there is a race.  See this dmesg excerpt:\n\n[   85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X\n[   85.170611]   alloc irq_desc for 99 on node -1\n[   85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X\n[   85.170614]   alloc kstat_irqs on node -1\n[   85.170616] alloc irq_2_iommu on node -1\n[   85.170617]   alloc irq_desc for 100 on node -1\n[   85.170619]   alloc kstat_irqs on node -1\n[   85.170621] alloc irq_2_iommu on node -1\n[   85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X\n[   85.170626]   alloc irq_desc for 101 on node -1\n[   85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X\n[   85.170630]   alloc kstat_irqs on node -1\n[   85.170631] alloc irq_2_iommu on node -1\n[   85.170635]   alloc irq_desc for 102 on node -1\n[   85.170636]   alloc kstat_irqs on node -1\n[   85.170639] alloc irq_2_iommu on node -1\n[   85.170646] BUG: unable to handle kernel NULL pointer dereference\nat 0000000000000088\n\nAs you can see igb and ixgbe are both alternating on create_irq_nr()\nvia pci_enable_msix() in their probe function.\n\nixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe\nchoses irq_desc_ptrs[102] and exits the loop, drops vector_lock and\ncalls dynamic_irq_init. Then it sets irq_desc_ptrs[102]-\u003echip_data \u003d\nNULL via dynamic_irq_init().\n\nigb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[]\nvia create_irq_nr(). It gets to irq_desc_ptrs[102] and does this:\n\n\tcfg_new \u003d irq_desc_ptrs[102]-\u003echip_data;\n\tif (cfg_new-\u003evector !\u003d 0)\n\t\tcontinue;\n\nThis hits the NULL deref.\n\nAnother possible race exists via pci_disable_msix() in a driver or in\nthe number of error paths that call free_msi_irqs():\n\ndestroy_irq()\ndynamic_irq_cleanup() which sets desc-\u003echip_data \u003d NULL\n...race window...\ndesc-\u003echip_data \u003d cfg;\n\nRemove the save and restore code for cfg in create_irq_nr() and\ndestroy_irq() and take the desc-\u003elock when checking the irq_cfg.\n\nReported-and-analyzed-by: Brandon Philips \u003cbphilips@suse.de\u003e\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nLKML-Reference: \u003c1265793639-15071-3-git-send-email-yinghai@kernel.org\u003e\nSigned-off-by: Brandon Phililps \u003cbphilips@suse.de\u003e\nCc: stable@kernel.org\nSigned-off-by: H. Peter Anvin \u003chpa@zytor.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "53243ca7816d131ee2821733b722ec0e4d8bd0b3",
      "old_mode": 33188,
      "old_path": "arch/x86/kernel/apic/io_apic.c",
      "new_id": "c86591b906fa85d62060ff80f9e8e3d1e65228f2",
      "new_mode": 33188,
      "new_path": "arch/x86/kernel/apic/io_apic.c"
    },
    {
      "type": "modify",
      "old_id": "451481c082b55c3f571e4dadc1d2b7b386bdfa9a",
      "old_mode": 33188,
      "old_path": "include/linux/irq.h",
      "new_id": "4d9b26e044bcb7ee02a3f2e4b4aed70e9c88d7c0",
      "new_mode": 33188,
      "new_path": "include/linux/irq.h"
    },
    {
      "type": "modify",
      "old_id": "ecc3fa28f66640ddc662e40340c634323f2196e9",
      "old_mode": 33188,
      "old_path": "kernel/irq/chip.c",
      "new_id": "d70394f12ee914e313057e2e560f96088a136af0",
      "new_mode": 33188,
      "new_path": "kernel/irq/chip.c"
    }
  ]
}