linux-kernel - Re: [Xen-devel] [PATCH] xen/events: Mask a moving irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56EAD55A.6020801@citrix.com>
Date:	Thu, 17 Mar 2016 16:03:38 +0000
From:	David Vrabel <david.vrabel@...rix.com>
To:	Boris Ostrovsky <boris.ostrovsky@...cle.com>,
	<david.vrabel@...rix.com>, <konrad.wilk@...cle.com>
CC:	<xen-devel@...ts.xenproject.org>, <linux-kernel@...r.kernel.org>,
	<stable@...r.kernel.org>
Subject: Re: [Xen-devel] [PATCH] xen/events: Mask a moving irq

On 17/03/16 12:45, Boris Ostrovsky wrote:
> Moving an unmasked irq may result in irq handler being invoked on both
> source and target CPUs.
> 
> With 2-level this can happen as follows:
> 
> On source CPU:
>         evtchn_2l_handle_events() ->
>             generic_handle_irq() ->
>                 handle_edge_irq() ->
>                    eoi_pirq():
>                        irq_move_irq(data);
> 
>                        /***** WE ARE HERE *****/
> 
>                        if (VALID_EVTCHN(evtchn))
>                            clear_evtchn(evtchn);
> 
> If at this moment target processor is handling an unrelated event in
> evtchn_2l_handle_events()'s loop it may pick up our event since target's
> cpu_evtchn_mask claims that this event belongs to it *and* the event is
> unmasked and still pending. At the same time, source CPU will continue
> executing its own handle_edge_irq().
> 
> With FIFO interrupt the scenario is similar: irq_move_irq() may result
> in a EVTCHNOP_unmask hypercall which, in turn, may make the event
> pending on the target CPU.
> 
> We can avoid this situation by moving and clearing the event while
> keeping event masked.

Can you do:

   if (unlikely(irqd_is_setaffinity_pending(data))) {
       masked = test_and_set_mask()

       clear_evtchn()
       irq_move_masked_irq()

       unmask(masked);
   } else
       clear_evtchn()

David