diff options
author | Keir Fraser <keir.fraser@citrix.com> | 2010-01-22 11:01:18 +0000 |
---|---|---|
committer | Keir Fraser <keir.fraser@citrix.com> | 2010-01-22 11:01:18 +0000 |
commit | e591bdb0182434f2886498a876f89ea7fdcff509 (patch) | |
tree | 206d6c2f3e616f64f425d2b2ed10bc75e661809f | |
parent | 939629eb5b1f143b12eee9396d6a8c8b1e0f3226 (diff) | |
download | xen-e591bdb0182434f2886498a876f89ea7fdcff509.tar.gz xen-e591bdb0182434f2886498a876f89ea7fdcff509.tar.bz2 xen-e591bdb0182434f2886498a876f89ea7fdcff509.zip |
x86: check if desc->action is NULL when unbinding guest pirq
Before igb PF driver is unloaded, dom0 doesn't unload igbvf driver
automatically. When igb drver is unloaded, it invokes the
PHYSDEVOP_manage_pci_remove hypercall to remove the VFs and xen frees
the msi irqs by pci_cleanup_msi() -> ... -> dynamic_irq_cleanup() and
sets the desc->action to NULL. igbvf driver knows the VF is
disappearing via a hook ndo_stop() in dev_close() and tries to unbind
the pirq and xen would crash as the desc->action is NULL now.
Signed-off-by: Dexuan Cui <dexuan.cui@intel.com>
-rw-r--r-- | xen/arch/x86/irq.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index 83c937bd33..7542f9d936 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -1229,6 +1229,13 @@ static irq_guest_action_t *__pirq_guest_unbind( BUG_ON(!(desc->status & IRQ_GUEST)); + if ( unlikely((desc->status | IRQ_DISABLED) && (desc->action == NULL)) ) + { + dprintk(XENLOG_G_WARNING, "dom%d: pirq %d: desc->action is NULL!\n", + d->domain_id, pirq); + return NULL; + } + action = (irq_guest_action_t *)desc->action; irq = desc - irq_desc; @@ -1353,6 +1360,13 @@ static int pirq_guest_force_unbind(struct domain *d, int irq) goto out; action = (irq_guest_action_t *)desc->action; + if ( unlikely((desc->status | IRQ_DISABLED) && (desc->action == NULL)) ) + { + dprintk(XENLOG_G_WARNING, "dom%d: pirq %d: desc->action is NULL!\n", + d->domain_id, irq); + goto out; + } + for ( i = 0; (i < action->nr_guests) && (action->guest[i] != d); i++ ) continue; if ( i == action->nr_guests ) |