linux-kernel - Re: pci-ftpci100: race condition in masking/unmasking interrupts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87czpkconx.wl-maz@kernel.org>
Date:   Tue, 07 Sep 2021 17:53:54 +0100
From:   Marc Zyngier <maz@...nel.org>
To:     Linus Walleij <linus.walleij@...aro.org>
Cc:     Pali Rohár <pali@...nel.org>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Rob Herring <robh@...nel.org>,
        linux-pci <linux-pci@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: pci-ftpci100: race condition in masking/unmasking interrupts

Hi Linus,

On Tue, 07 Sep 2021 12:22:37 +0100,
Linus Walleij <linus.walleij@...aro.org> wrote:
> 
> On Wed, Aug 18, 2021 at 1:47 PM Pali Rohár <pali@...nel.org> wrote:
> 
> > I do not see any entry in MAINTAINERS file for pci-ftpci100.c driver, so
> > I'm not sure to whom should I address this issue...
> 
> It's me.
> 
> > During pci-aardvark review, Marc pointed one issue which is currently
> > available also in pci-ftpci100.c driver.
> >
> > When masking or unmasking interrupts there is read-modify-write sequence
> > for FARADAY_PCI_CTRL2 register without any locking and is not atomic:
> >
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/pci/controller/pci-ftpci100.c?h=v5.13#n270
> >
> > So there is race condition when masking/unmasking more interrupts at the
> > same time.
> 
> I thought those operations were called in atomic context.
> How did you fix it?

They are.

But that doesn't mean that you cannot have two CPUs dealing with two
different interrupts at the same time (using disable_irq(), for
example). When that happens, your interrupt masking becomes a bit
soup. irq_ack() also gets in the way, as it does a RMW of the same
register. If the underlying HW is strictly UP, you're safe. But even
in this case, you could have some locking that gets elided at compile
time.

I also don't understand why you always clear the interrupt status
every time you mask/unmask an interrupt.

I came up with the following patchlet, which is completely untested
(not even compile-tested).

Thanks,

	M.

diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c
index 88980a44461d..dd1697e61206 100644
--- a/drivers/pci/controller/pci-ftpci100.c
+++ b/drivers/pci/controller/pci-ftpci100.c
@@ -120,6 +120,7 @@ struct faraday_pci_variant {
 };
 
 struct faraday_pci {
+	raw_spinlock_t lock
 	struct device *dev;
 	void __iomem *base;
 	struct irq_domain *irqdomain;
@@ -270,34 +271,41 @@ static struct pci_ops faraday_pci_ops = {
 static void faraday_pci_ack_irq(struct irq_data *d)
 {
 	struct faraday_pci *p = irq_data_get_irq_chip_data(d);
+	unsigned long flags;
 	unsigned int reg;
 
+	raw_spin_lock_irqsave(&p->lock, flags);
 	faraday_raw_pci_read_config(p, 0, 0, FARADAY_PCI_CTRL2, 4, &reg);
 	reg &= ~(0xF << PCI_CTRL2_INTSTS_SHIFT);
 	reg |= BIT(irqd_to_hwirq(d) + PCI_CTRL2_INTSTS_SHIFT);
 	faraday_raw_pci_write_config(p, 0, 0, FARADAY_PCI_CTRL2, 4, reg);
+	raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static void faraday_pci_mask_irq(struct irq_data *d)
 {
 	struct faraday_pci *p = irq_data_get_irq_chip_data(d);
+	unsigned long flags;
 	unsigned int reg;
 
+	raw_spin_lock_irqsave(&p->lock, flags);
 	faraday_raw_pci_read_config(p, 0, 0, FARADAY_PCI_CTRL2, 4, &reg);
-	reg &= ~((0xF << PCI_CTRL2_INTSTS_SHIFT)
-		 | BIT(irqd_to_hwirq(d) + PCI_CTRL2_INTMASK_SHIFT));
+	reg &= ~BIT(irqd_to_hwirq(d) + PCI_CTRL2_INTMASK_SHIFT);
 	faraday_raw_pci_write_config(p, 0, 0, FARADAY_PCI_CTRL2, 4, reg);
+	raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static void faraday_pci_unmask_irq(struct irq_data *d)
 {
 	struct faraday_pci *p = irq_data_get_irq_chip_data(d);
+	unsigned long flags;
 	unsigned int reg;
 
+	raw_spin_lock_irqsave(&p->lock, flags);
 	faraday_raw_pci_read_config(p, 0, 0, FARADAY_PCI_CTRL2, 4, &reg);
-	reg &= ~(0xF << PCI_CTRL2_INTSTS_SHIFT);
 	reg |= BIT(irqd_to_hwirq(d) + PCI_CTRL2_INTMASK_SHIFT);
 	faraday_raw_pci_write_config(p, 0, 0, FARADAY_PCI_CTRL2, 4, reg);
+	raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static void faraday_pci_irq_handler(struct irq_desc *desc)
@@ -441,6 +449,8 @@ static int faraday_pci_probe(struct platform_device *pdev)
 	host->sysdata = p;
 	p->dev = dev;
 
+	raw_spin_lock_init(&p->lock);
+
 	/* Retrieve and enable optional clocks */
 	clk = devm_clk_get(dev, "PCLK");
 	if (IS_ERR(clk))

-- 
Without deviation from the norm, progress is not possible.