[Bug Report] Potential atomicity violation bug in drivers/misc/sgi-xp/xpc_uv.c, between 'xpc_send_activate_IRQ_uv()' and 'xpc_teardown_partitions_uv()'
From: Ginger
Date: Thu Apr 23 2026 - 00:44:43 EST
Dear Linux kernel maintainers,
My research-based static analyzer found a potential atomicity bug
within the 'drivers/misc/sgi-xp' subsystem, more specifically, in
'drivers/misc/sgi-xp/xpc_uv.c'.
Kernel version: long-term kernel v6.18.9
Potential concurrent triggering executions:
T0:
xpc_send_activate_IRQ_uv
--> read part_uv->flags & XPC_P_CACHED_ACTIVATE_GRU_MQ_DESC_UV
--> access part_uv->cached_activate_gru_mq_desc
T1:
xpc_teardown_partitions_uv
--> spin_lock_irqsave(&part_uv->flags_lock, irq_flags)
--> part_uv->flags &= ~XPC_P_CACHED_ACTIVATE_GRU_MQ_DESC_UV;
--> spin_unlock_irqrestore(&part_uv->flags_lock, irq_flags);
In T0, the read to part_uv->flags is not protected by the flags_lock,
causing potential partial reads and data race scenarios.
Please kindly check at your convenience. Thank you for your time and
consideration.
Best regards,
Ginger