linux-kernel - [PATCH v2 2/3] genirq/irqdomain: Re-check mapping after associate in irq_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190927150025.26481-3-alexander.sverdlin@nokia.com>
Date:   Fri, 27 Sep 2019 15:00:44 +0000
From:   "Sverdlin, Alexander (Nokia - DE/Ulm)" <alexander.sverdlin@...ia.com>
To:     Marc Zyngier <maz@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Grant Likely <grant.likely@...retlab.ca>
CC:     "Sverdlin, Alexander (Nokia - DE/Ulm)" <alexander.sverdlin@...ia.com>,
        Mark Brown <broonie@...nel.org>,
        Jon Hunter <jonathanh@...dia.com>,
        "Glavinic-Pecotic, Matija (EXT - DE/Ulm)" 
        <matija.glavinic-pecotic.ext@...ia.com>,
        "Adamski, Krzysztof (Nokia - PL/Wroclaw)" 
        <krzysztof.adamski@...ia.com>,
        "Bachorski, Tomasz (Nokia - PL/Wroclaw)" <tomasz.bachorski@...ia.com>,
        "Kosnikowski, Wojciech (Nokia - PL/Wroclaw)" 
        <wojciech.kosnikowski@...ia.com>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: [PATCH v2 2/3] genirq/irqdomain: Re-check mapping after associate in
 irq_create_mapping()

From: Alexander Sverdlin <alexander.sverdlin@...ia.com>

If two irq_create_mapping() calls perform a mapping of the same hwirq on
two CPU cores in parallel they both will get 0 from irq_find_mapping(),
both will allocate unique virq using irq_domain_alloc_descs() and both
will finally irq_domain_associate() it. Giving different virq numbers
to their callers.

In practice the first caller is usually an interrupt controller driver and
the seconds is some device requesting the interrupt providede by the above
interrupt controller.

In this case either the interrupt controller driver configures virq which
is not the one being "associated" with hwirq, or the "slave" device
requests the virq which is never being triggered.

Reported-by: Krzysztof Adamski <krzysztof.adamski@...ia.com>
Reported-by: Tomasz Bachorski <tomasz.bachorski@...ia.com>
Reported-by: Wojciech Kosnikowski <wojciech.kosnikowski@...ia.com>
Cc: stable@...r.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@...ia.com>
---
 kernel/irq/irqdomain.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index ccbb048..ad62c08 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -661,6 +661,7 @@ unsigned int irq_create_mapping(struct irq_domain *domain,
 {
 	struct device_node *of_node;
 	int virq;
+	int ret;
 
 	pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq);
 
@@ -675,13 +676,6 @@ unsigned int irq_create_mapping(struct irq_domain *domain,
 
 	of_node = irq_domain_get_of_node(domain);
 
-	/* Check if mapping already exists */
-	virq = irq_find_mapping(domain, hwirq);
-	if (virq) {
-		pr_debug("-> existing mapping on virq %d\n", virq);
-		return virq;
-	}
-
 	/* Allocate a virtual interrupt number */
 	virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node), NULL);
 	if (virq <= 0) {
@@ -689,8 +683,11 @@ unsigned int irq_create_mapping(struct irq_domain *domain,
 		return 0;
 	}
 
-	if (irq_domain_associate(domain, virq, hwirq)) {
+	ret = irq_domain_associate(domain, virq, hwirq);
+	if (ret) {
 		irq_free_desc(virq);
+		if (ret == -EEXIST)
+			return irq_find_mapping(domain, hwirq);
 		return 0;
 	}
 
-- 
2.4.6