linux-kernel - Re: [PATCH 1/4] KVM: x86: fix interrupt dropping race in PIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160204133559.GB16897@potion.brq.redhat.com>
Date:	Thu, 4 Feb 2016 14:35:59 +0100
From:	Radim Krčmář <rkrcmar@...hat.com>
To:	linux-kernel@...r.kernel.org
Cc:	kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>,
	Yuki Shibuya <shibuya.yk@...s.nec.co.jp>
Subject: Re: [PATCH 1/4] KVM: x86: fix interrupt dropping race in PIT

2016-02-03 17:23+0100, Radim Krčmář:
> A misuse of atomic operations opened a window
> 
>              kvm_pit_ack_irq:              |         pit_timer_fn:
>   value = atomic_dec_return(&ps->pending); |
>                                            |  !atomic_read(&ps->pending)
>   if (value < 0) atomic_inc(&ps->pending); |
> 
> If ps->pending starts as 0 and we are using the discard policy, we don't
> inject any interrupt in kvm_pit_ack_irq or pit_timer_fn, leading to a
> missed PIT cycle.
> 
> Signed-off-by: Radim Krčmář <rkrcmar@...hat.com>
> ---
> diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
> @@ -239,13 +239,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian)
>  	int value;
>  
>  	spin_lock(&ps->inject_lock);
> -	value = atomic_dec_return(&ps->pending);
> -	if (value < 0)
> -		/* spurious acks can be generated if, for example, the
> -		 * PIC is being reset.  Handle it gracefully here
> -		 */
> -		atomic_inc(&ps->pending);
> -	else if (value > 0)
> +	if (atomic_add_unless(&ps->pending, -1, 0))

This is not right, I'll redo the series.  Sorry.