linux-kernel - Re: [RFC][PATCH] IRQ: Fix oneshot irq race between irq_finalize_oneshot and handle_level

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.00.1003090855250.22855@localhost.localdomain>
Date:	Tue, 9 Mar 2010 08:58:11 +0100 (CET)
From:	Thomas Gleixner <tglx@...utronix.de>
To:	Lars-Peter Clausen <lars@...afoo.de>
cc:	Ingo Molnar <mingo@...e.hu>, linux-kernel@...r.kernel.org
Subject: Re: [RFC][PATCH] IRQ: Fix oneshot irq race between irq_finalize_oneshot
 and handle_level_irq

On Tue, 9 Mar 2010, Lars-Peter Clausen wrote:

> If the kernel has been compiled with preemtion support and handle_level_irq is
> called from process context for a oneshot irq there is a race between
> irq_finalize_oneshot and handle_level_irq which results in the irq not being
> unmasked after its handlers have been run.
> 
> irq_finalize_oneshot is expected to unmask the irq after the threaded irq
> handler has been run. It only does so if IRQ_MASKED is set for the irqs status.
> IRQ_MASKED gets set in the lower part of handle_level_irq after handle_IRQ_event
> has been called.
> handle_IRQ_event will wakeup the oneshot irqs threaded handler and if the
> kernel has been build with preemption there is a chance that the threaded irq
> handler will finish before execution is returned to handle_level_irq.
> As a result irq_finalize_oneshot will not unmask the irq and handle_level_irq
> will set the IRQ_MASKED flag. Thus the irq will stay masked and stalls.
> 
> In case of an race the call-graph would look like this:
>  handle_level_irq
>  |- mask_ack_irq
>  |- handle_IRQ_event
>     |- wake_up_process
>        |- irq_thread
>           |- action->thread_fn
>           |- irq_finalize_oneshot # Does not unmask the irq
> |- # Set IRQ_MASKED status flag

Errm, a thread _CANNOT_ preempt a hard interrupt handler.

Thanks,

	tglx
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/