linux-kernel - [irqchip: irq/irqchip-fixes] irqchip/gic, gic-v3: Prevent GSI to SGI translations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 05 Apr 2022 15:39:58 -0000
From:   "irqchip-bot for Andre Przywara" <tip-bot2@...utronix.de>
To:     linux-kernel@...r.kernel.org
Cc:     Andre Przywara <andre.przywara@....com>,
        Marc Zyngier <maz@...nel.org>, tglx@...utronix.de
Subject: [irqchip: irq/irqchip-fixes] irqchip/gic, gic-v3: Prevent GSI to SGI
 translations

The following commit has been merged into the irq/irqchip-fixes branch of irqchip:

Commit-ID:     544808f7e21cb9ccdb8f3aa7de594c05b1419061
Gitweb:        https://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms/544808f7e21cb9ccdb8f3aa7de594c05b1419061
Author:        Andre Przywara <andre.przywara@....com>
AuthorDate:    Mon, 04 Apr 2022 12:08:42 +01:00
Committer:     Marc Zyngier <maz@...nel.org>
CommitterDate: Tue, 05 Apr 2022 16:33:47 +01:00

irqchip/gic, gic-v3: Prevent GSI to SGI translations

At the moment the GIC IRQ domain translation routine happily converts
ACPI table GSI numbers below 16 to GIC SGIs (Software Generated
Interrupts aka IPIs). On the Devicetree side we explicitly forbid this
translation, actually the function will never return HWIRQs below 16 when
using a DT based domain translation.

We expect SGIs to be handled in the first part of the function, and any
further occurrence should be treated as a firmware bug, so add a check
and print to report this explicitly and avoid lengthy debug sessions.

Fixes: 64b499d8df40 ("irqchip/gic-v3: Configure SGIs as standard interrupts")
Signed-off-by: Andre Przywara <andre.przywara@....com>
Signed-off-by: Marc Zyngier <maz@...nel.org>
Link: https://lore.kernel.org/r/20220404110842.2882446-1-andre.przywara@arm.com
---
 drivers/irqchip/irq-gic-v3.c | 6 ++++++
 drivers/irqchip/irq-gic.c    | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 9b63165..b252d55 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -1466,6 +1466,12 @@ static int gic_irq_domain_translate(struct irq_domain *d,
 		if(fwspec->param_count != 2)
 			return -EINVAL;
 
+		if (fwspec->param[0] < 16) {
+			pr_err(FW_BUG "Illegal GSI%d translation request\n",
+			       fwspec->param[0]);
+			return -EINVAL;
+		}
+
 		*hwirq = fwspec->param[0];
 		*type = fwspec->param[1];
 
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 58ba835..09c710e 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -1123,6 +1123,12 @@ static int gic_irq_domain_translate(struct irq_domain *d,
 		if(fwspec->param_count != 2)
 			return -EINVAL;
 
+		if (fwspec->param[0] < 16) {
+			pr_err(FW_BUG "Illegal GSI%d translation request\n",
+			       fwspec->param[0]);
+			return -EINVAL;
+		}
+
 		*hwirq = fwspec->param[0];
 		*type = fwspec->param[1];