Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICEDX1 ------------------ disable_irq() and debugfs_create_symlink() might sleep, local_irq_disable() will mask IRQS on current PE. Because sleep is not allowed when interrupts are disabled, the following bug occurs. So move them out of local_irq_disable/enable() to fix it. BUG: sleeping function called from invalid context at kernel/irq/manage.c:737 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1033, name: bash preempt_count: 0, expected: 0 CPU: 1 PID: 1033 Comm: bash Not tainted 6.6.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0xf8/0x290 show_stack+0x3c/0x70 dump_stack_lvl+0x1a8/0x2e8 dump_stack+0x34/0x50 __might_resched+0x31c/0x5f8 __might_sleep+0xc8/0x1d8 disable_irq+0x48/0xb8 xint_proc_write+0x1b0/0x3f8 proc_reg_write+0x218/0x348 vfs_write+0x244/0xfd0 ksys_write+0x11c/0x290 __arm64_sys_write+0x8c/0xd8 invoke_syscall+0xb4/0x300 el0_svc_common.constprop.0+0x1f8/0x310 do_el0_svc+0x5c/0x88 el0_svc+0x44/0x200 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3b8/0x3c0 BUG: sleeping function called from invalid context at mm/slab.h:494 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 414, name: bash CPU: 0 PID: 414 Comm: bash Tainted: G W 5.10.0-00033-gee505d161ada #4 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x430 show_stack+0x34/0x4c dump_stack+0x1d0/0x248 ___might_sleep+0x15c/0x1bc __might_sleep+0x7c/0x114 __kmalloc_track_caller+0x198/0x87c kstrdup+0x134/0x1d0 debugfs_create_symlink+0x3c/0x250 xint_add_debugfs_entry+0xd4/0x140 xint_transform+0x1f4/0x210 xint_proc_write+0x26c/0x344 proc_reg_write+0x184/0x210 vfs_write+0x17c/0x634 ksys_write+0x104/0x230 __arm64_sys_write+0x54/0x80 invoke_syscall+0x84/0x230 el0_xcall_common.constprop.0+0x1ec/0x204 do_el0_xcall+0x98/0x18c el0_xcall_handler+0x24/0x3c el0_sync+0x17c/0x194 Fixes: 63f9ef213a47 ("arm64: Add debugfs dir for xint") Fixes: 3053668e6b21 ("arm64: Introduce Xint software solution") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> --- drivers/irqchip/irq-gic-v3.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 9d2a5cc50c33..4805b3280acc 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -1030,11 +1030,9 @@ static bool xint_transform(int irqno, enum xint_op op) switch (op) { case IRQ_TO_XINT: set_bit(hwirq, irqnr_xint_map); - xint_add_debugfs_entry(irqno); return true; case XINT_TO_IRQ: clear_bit(hwirq, irqnr_xint_map); - xint_remove_debugfs_entry(irqno); return false; case XINT_SET_CHECK: return test_bit(hwirq, irqnr_xint_map); @@ -1049,6 +1047,7 @@ static ssize_t xint_proc_write(struct file *file, const char __user *buffer, size_t count, loff_t *pos) { int irq = (int)(long)pde_data(file_inode(file)); + enum xint_op switch_type; bool xint_state = false; unsigned long val; char *buf = NULL; @@ -1071,13 +1070,21 @@ static ssize_t xint_proc_write(struct file *file, return -EBUSY; } - local_irq_disable(); + if (xint_state) { + switch_type = XINT_TO_IRQ; + xint_remove_debugfs_entry(irq); + } else { + switch_type = IRQ_TO_XINT; + xint_add_debugfs_entry(irq); + } + disable_irq(irq); + local_irq_disable(); - xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); + xint_transform(irq, switch_type); - enable_irq(irq); local_irq_enable(); + enable_irq(irq); kfree(buf); -- 2.34.1