LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Maximilian Heyne <mheyne@amazon.de>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 09/43] xen/events: Fix race in set_evtchn_to_irq
Date: Tue, 24 Aug 2021 13:05:40 -0400	[thread overview]
Message-ID: <20210824170614.710813-10-sashal@kernel.org> (raw)
In-Reply-To: <20210824170614.710813-1-sashal@kernel.org>

From: Maximilian Heyne <mheyne@amazon.de>

[ Upstream commit 88ca2521bd5b4e8b83743c01a2d4cb09325b51e9 ]

There is a TOCTOU issue in set_evtchn_to_irq. Rows in the evtchn_to_irq
mapping are lazily allocated in this function. The check whether the row
is already present and the row initialization is not synchronized. Two
threads can at the same time allocate a new row for evtchn_to_irq and
add the irq mapping to the their newly allocated row. One thread will
overwrite what the other has set for evtchn_to_irq[row] and therefore
the irq mapping is lost. This will trigger a BUG_ON later in
bind_evtchn_to_cpu:

  INFO: pci 0000:1a:15.4: [1d0f:8061] type 00 class 0x010802
  INFO: nvme 0000:1a:12.1: enabling device (0000 -> 0002)
  INFO: nvme nvme77: 1/0/0 default/read/poll queues
  CRIT: kernel BUG at drivers/xen/events/events_base.c:427!
  WARN: invalid opcode: 0000 [#1] SMP NOPTI
  WARN: Workqueue: nvme-reset-wq nvme_reset_work [nvme]
  WARN: RIP: e030:bind_evtchn_to_cpu+0xc2/0xd0
  WARN: Call Trace:
  WARN:  set_affinity_irq+0x121/0x150
  WARN:  irq_do_set_affinity+0x37/0xe0
  WARN:  irq_setup_affinity+0xf6/0x170
  WARN:  irq_startup+0x64/0xe0
  WARN:  __setup_irq+0x69e/0x740
  WARN:  ? request_threaded_irq+0xad/0x160
  WARN:  request_threaded_irq+0xf5/0x160
  WARN:  ? nvme_timeout+0x2f0/0x2f0 [nvme]
  WARN:  pci_request_irq+0xa9/0xf0
  WARN:  ? pci_alloc_irq_vectors_affinity+0xbb/0x130
  WARN:  queue_request_irq+0x4c/0x70 [nvme]
  WARN:  nvme_reset_work+0x82d/0x1550 [nvme]
  WARN:  ? check_preempt_wakeup+0x14f/0x230
  WARN:  ? check_preempt_curr+0x29/0x80
  WARN:  ? nvme_irq_check+0x30/0x30 [nvme]
  WARN:  process_one_work+0x18e/0x3c0
  WARN:  worker_thread+0x30/0x3a0
  WARN:  ? process_one_work+0x3c0/0x3c0
  WARN:  kthread+0x113/0x130
  WARN:  ? kthread_park+0x90/0x90
  WARN:  ret_from_fork+0x3a/0x50

This patch sets evtchn_to_irq rows via a cmpxchg operation so that they
will be set only once. The row is now cleared before writing it to
evtchn_to_irq in order to not create a race once the row is visible for
other threads.

While at it, do not require the page to be zeroed, because it will be
overwritten with -1's in clear_evtchn_to_irq_row anyway.

Signed-off-by: Maximilian Heyne <mheyne@amazon.de>
Fixes: d0b075ffeede ("xen/events: Refactor evtchn_to_irq array to be dynamically allocated")
Link: https://lore.kernel.org/r/20210812130930.127134-1-mheyne@amazon.de
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/events/events_base.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index c6e6b7470cbf..fbb6a4701ea3 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -134,12 +134,12 @@ static void disable_dynirq(struct irq_data *data);
 
 static DEFINE_PER_CPU(unsigned int, irq_epoch);
 
-static void clear_evtchn_to_irq_row(unsigned row)
+static void clear_evtchn_to_irq_row(int *evtchn_row)
 {
 	unsigned col;
 
 	for (col = 0; col < EVTCHN_PER_ROW; col++)
-		WRITE_ONCE(evtchn_to_irq[row][col], -1);
+		WRITE_ONCE(evtchn_row[col], -1);
 }
 
 static void clear_evtchn_to_irq_all(void)
@@ -149,7 +149,7 @@ static void clear_evtchn_to_irq_all(void)
 	for (row = 0; row < EVTCHN_ROW(xen_evtchn_max_channels()); row++) {
 		if (evtchn_to_irq[row] == NULL)
 			continue;
-		clear_evtchn_to_irq_row(row);
+		clear_evtchn_to_irq_row(evtchn_to_irq[row]);
 	}
 }
 
@@ -157,6 +157,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
 {
 	unsigned row;
 	unsigned col;
+	int *evtchn_row;
 
 	if (evtchn >= xen_evtchn_max_channels())
 		return -EINVAL;
@@ -169,11 +170,18 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
 		if (irq == -1)
 			return 0;
 
-		evtchn_to_irq[row] = (int *)get_zeroed_page(GFP_KERNEL);
-		if (evtchn_to_irq[row] == NULL)
+		evtchn_row = (int *) __get_free_pages(GFP_KERNEL, 0);
+		if (evtchn_row == NULL)
 			return -ENOMEM;
 
-		clear_evtchn_to_irq_row(row);
+		clear_evtchn_to_irq_row(evtchn_row);
+
+		/*
+		 * We've prepared an empty row for the mapping. If a different
+		 * thread was faster inserting it, we can drop ours.
+		 */
+		if (cmpxchg(&evtchn_to_irq[row], NULL, evtchn_row) != NULL)
+			free_page((unsigned long) evtchn_row);
 	}
 
 	WRITE_ONCE(evtchn_to_irq[row][col], irq);
-- 
2.30.2


  parent reply	other threads:[~2021-08-24 17:36 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-24 17:05 [PATCH 4.9 00/43] 4.9.281-rc1 review Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 01/43] iio: adc: Fix incorrect exit of for-loop Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 02/43] ASoC: intel: atom: Fix reference to PCM buffer address Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 03/43] i2c: dev: zero out array used for i2c reads from userspace Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 04/43] ACPI: NFIT: Fix support for virtual SPA ranges Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 05/43] ppp: Fix generating ifname when empty IFLA_IFNAME is specified Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 06/43] net: Fix memory leak in ieee802154_raw_deliver Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 07/43] net: bridge: fix memleak in br_add_if() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 08/43] tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets Sasha Levin
2021-08-24 17:05 ` Sasha Levin [this message]
2021-08-24 17:05 ` [PATCH 4.9 10/43] x86/tools: Fix objdump version check again Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 11/43] PCI/MSI: Enable and mask MSI-X early Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 12/43] PCI/MSI: Do not set invalid bits in MSI mask Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 13/43] PCI/MSI: Correct misleading comments Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 14/43] PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 15/43] PCI/MSI: Protect msi_desc::masked for multi-MSI Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 16/43] PCI/MSI: Mask all unused MSI-X entries Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 17/43] PCI/MSI: Enforce that MSI-X table entry is masked for update Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 18/43] PCI/MSI: Enforce MSI[X] entry updates to be visible Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 19/43] vmlinux.lds.h: Handle clang's module.{c,d}tor sections Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 20/43] mac80211: drop data frames without key on encrypted links Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 21/43] KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 22/43] x86/fpu: Make init_fpstate correct with optimized XSAVE Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 23/43] dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 24/43] ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 25/43] dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 26/43] scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 27/43] scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 28/43] scsi: core: Avoid printing an error if target_alloc() returns -ENXIO Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 29/43] ARM: dts: nomadik: Fix up interrupt controller node names Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 30/43] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 31/43] dccp: add do-while-0 stubs for dccp_pr_debug macros Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 32/43] vhost: Fix the calculation in vhost_overflow() Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 33/43] net: 6pack: fix slab-out-of-bounds in decode_data Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 34/43] net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 35/43] mmc: dw_mmc: call the dw_mci_prep_stop_abort() by default Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 36/43] mmc: dw_mmc: Fix hang on data CRC error Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 37/43] ALSA: hda - fix the 'Capture Switch' value change notifications Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 38/43] ipack: tpci200: fix many double free issues in tpci200_pci_probe Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 39/43] btrfs: prevent rename2 from exchanging a subvol with a directory from different parents Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 40/43] ASoC: intel: atom: Fix breakage for PCM buffer address setup Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 41/43] locks: print a warning when mount fails due to lack of "mand" support Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 42/43] fs: warn about impending deprecation of mandatory locks Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 43/43] Linux 4.9.281-rc1 Sasha Levin
2021-08-25 20:26 ` [PATCH 4.9 00/43] 4.9.281-rc1 review Guenter Roeck
2021-08-25 21:17 ` Daniel Díaz
2021-08-25 22:37 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210824170614.710813-10-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=boris.ostrovsky@oracle.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mheyne@amazon.de \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH 4.9 09/43] xen/events: Fix race in set_evtchn_to_irq' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).