linux-kernel - Re: [PATCH 6/9] pm/irq: make for_each_irq_desc() safe of irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YmDP93yLJw5gsjtQ@piliu.users.ipa.redhat.com>
Date:   Thu, 21 Apr 2022 11:31:03 +0800
From:   Pingfan Liu <kernelfans@...il.com>
To:     "Rafael J. Wysocki" <rafael@...nel.org>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH 6/9] pm/irq: make for_each_irq_desc() safe of irq_desc
 release

On Wed, Apr 20, 2022 at 06:23:48PM +0200, Rafael J. Wysocki wrote:
> On Wed, Apr 20, 2022 at 4:06 PM Pingfan Liu <kernelfans@...il.com> wrote:
> >
> > The invloved context is no a RCU read section. Furthermore there may be
> > more than one task at this point. Hence it demands a measure to prevent
> > irq_desc from freeing. Use irq_lock_sparse to serve the protection
> > purpose.
> 
> Can you please describe an example scenario in which the added locking
> will prevent a failure from occurring?
> 

Sorry to forget mentioning that this is based on the code analysis.

Suppose the following scenario:
Two threads invloved
  threadA "hibernate" runs suspend_device_irqs()
  threadB "rcu_cpu_kthread" runs rcu_core()->rcu_do_batch(), which releases
  object, let's say irq_desc

Zoom in:
  threadA                                               threadB
  for_each_irq_desc(irq, desc) {
      get irq_descA which is under freeing
                                                    --->preempted by rcu_core()->rcu_do_batch()  which releases irq_descA
      raw_spin_lock_irqsave(&desc->lock, flags);
      //Oops

And since in the involved code piece, threadA runs in a preemptible
context, and there may be more than one thread at this stage. So the
preempted can happen.


Thanks,

	Pingfan


> > Signed-off-by: Pingfan Liu <kernelfans@...il.com>
> > Cc: Thomas Gleixner <tglx@...utronix.de>
> > Cc: "Rafael J. Wysocki" <rafael@...nel.org>
> > To: linux-kernel@...r.kernel.org
> > ---
> >  kernel/irq/pm.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
> > index ca71123a6130..4b67a4c7de3c 100644
> > --- a/kernel/irq/pm.c
> > +++ b/kernel/irq/pm.c
> > @@ -133,6 +133,7 @@ void suspend_device_irqs(void)
> >         struct irq_desc *desc;
> >         int irq;
> >
> > +       irq_lock_sparse();
> >         for_each_irq_desc(irq, desc) {
> >                 unsigned long flags;
> >                 bool sync;
> > @@ -146,6 +147,7 @@ void suspend_device_irqs(void)
> >                 if (sync)
> >                         synchronize_irq(irq);
> >         }
> > +       irq_unlock_sparse();
> >  }
> >  EXPORT_SYMBOL_GPL(suspend_device_irqs);
> >
> > @@ -186,6 +188,7 @@ static void resume_irqs(bool want_early)
> >         struct irq_desc *desc;
> >         int irq;
> >
> > +       /* The early resume stage is free of irq_desc release */
> >         for_each_irq_desc(irq, desc) {
> >                 unsigned long flags;
> >                 bool is_early = desc->action &&
> > --
> > 2.31.1
> >