Re: [PATCH v3 4/8] s390/pci: Fix use-after-free race in zpci floating interrupt cleanup

[Niklas Schnelle]

On Fri, 2026-10-09 at 08:15 +0200, Tobias Schumacher wrote:
> zpci_clear_irq() stops the adapter from raising new interrupts for the
> function, but a zpci_floating_irq_handler() already running on another CPU
> can still be scanning zdev->aibv when zpci_msi_teardown_floating() releases
> it.
> 
> Clear the zpci_ibv[] entry so no further handler picks the vector up, then
> wait for a grace period before releasing it. The handler runs inside the
> rcu_read_lock() section that do_airq_interrupt() holds across
> airq->handler(), so synchronize_rcu() drains any handler still in flight.
> Release the vector and free the summary bit only after the grace period, so
> neither can be reused while a reader still holds the old pointer.
> 
> zpci_ibv served both delivery modes, indexed by function under
> FLOATING and by cpu under DIRECTED. Only the floating vectors are
> published to and torn down under the interrupt handler, so split the
> directed vectors out into zpci_dibv and annotate zpci_ibv __rcu, which
> lets sparse check the accessors above.
> 
> Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tobias Schumacher <ts@xxxxxxxxxxxxx>
> ---
>  arch/s390/pci/pci_irq.c | 58 +++++++++++++++++++++++++++----------------------
>  1 file changed, 32 insertions(+), 26 deletions(-)
> 

I agree with Tobias' assessment of the Sashiko reported issue and doing
it in a separate patch. Code looks good to me and fixes a real race.

Thanks for the great work! Please feel free to add my

Reviewed-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>