linux-kernel - [PATCH] genirq: Dont allow affinity mask to be updated on IPIs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1461229712-13057-1-git-send-email-matt.redfearn@imgtec.com>
Date:	Thu, 21 Apr 2016 10:08:32 +0100
From:	Matt Redfearn <matt.redfearn@...tec.com>
To:	Thomas Gleixner <tglx@...utronix.de>
CC:	<lisa.parratt@...tec.com>, <jason@...edaemon.net>,
	<ralf@...ux-mips.org>, <linux-kernel@...r.kernel.org>,
	<jiang.liu@...ux.intel.com>, <marc.zyngier@....com>,
	<linux-mips@...ux-mips.org>, Qais Yousef <qsyousef@...il.com>,
	Matt Redfearn <matt.redfearn@...tec.com>
Subject: [PATCH] genirq: Dont allow affinity mask to be updated on IPIs

The IPI domain re-purposes the IRQ affinity to signify the mask of CPUs
that this IPI will deliver to. This must not be modified before the IPI
is destroyed again, so set the IRQ_NO_BALANCING flag to prevent the
affinity being overwritten by setup_affinity().

Without this, if an IPI is reserved for a single target CPU, then
allocated using __setup_irq(), the affinity is overwritten with
cpu_online_mask. When ipi_destroy() is subsequently called on a
multi-cpu system, it will attempt to free cpumask_weight() IRQs
that were never allocated, and crash.

Fixes: d17bf24e6952 ("genirq: Add a new generic IPI reservation code to
irq core")
Signed-off-by: Matt Redfearn <matt.redfearn@...tec.com>
---

 kernel/irq/ipi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/irq/ipi.c b/kernel/irq/ipi.c
index c37f34b00a11..14777af8e097 100644
--- a/kernel/irq/ipi.c
+++ b/kernel/irq/ipi.c
@@ -94,6 +94,7 @@ unsigned int irq_reserve_ipi(struct irq_domain *domain,
 		data = irq_get_irq_data(virq + i);
 		cpumask_copy(data->common->affinity, dest);
 		data->common->ipi_offset = offset;
+		irq_set_status_flags(virq + i, IRQ_NO_BALANCING);
 	}
 	return virq;

-- 
2.5.0