lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 27 Apr 2022 14:03:38 +0800 From: Pingfan Liu <kernelfans@...il.com> To: linux-kernel@...r.kernel.org Cc: Pingfan Liu <kernelfans@...il.com>, Thomas Gleixner <tglx@...utronix.de>, "Rafael J. Wysocki" <rafael@...nel.org> Subject: [PATCHv2] genirq/PM: Make for_each_irq_desc() safe of irq_desc release First, this is a suspicion of the code, not a really encountered bug. *** The scenario *** Two threads involved threadA "hibernate" runs suspend_device_irqs() threadB "rcu_cpu_kthread" runs rcu_core()->rcu_do_batch(), which releases object, let's say irq_desc Zoom in: threadA threadB for_each_irq_desc(irq, desc) { get irq_descA which is under freeing --->preempted by rcu_core()->rcu_do_batch() which releases irq_descA raw_spin_lock_irqsave(&desc->lock, flags); //Oops And since in the involved code piece, suspend_device_irqs() runs in a preemptible context, and there may be more than one thread at this point. So the preemption can happen. *** The fix *** Since there is a blockable synchronize_irq() inside the code piece, resorting to irq_lock_sparse() to protect the irq_desc from disappearing. Signed-off-by: Pingfan Liu <kernelfans@...il.com> Cc: Thomas Gleixner <tglx@...utronix.de> Cc: "Rafael J. Wysocki" <rafael@...nel.org> To: linux-kernel@...r.kernel.org --- v1 -> v2: improve commit log kernel/irq/pm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c index ca71123a6130..4b67a4c7de3c 100644 --- a/kernel/irq/pm.c +++ b/kernel/irq/pm.c @@ -133,6 +133,7 @@ void suspend_device_irqs(void) struct irq_desc *desc; int irq; + irq_lock_sparse(); for_each_irq_desc(irq, desc) { unsigned long flags; bool sync; @@ -146,6 +147,7 @@ void suspend_device_irqs(void) if (sync) synchronize_irq(irq); } + irq_unlock_sparse(); } EXPORT_SYMBOL_GPL(suspend_device_irqs); @@ -186,6 +188,7 @@ static void resume_irqs(bool want_early) struct irq_desc *desc; int irq; + /* The early resume stage is free of irq_desc release */ for_each_irq_desc(irq, desc) { unsigned long flags; bool is_early = desc->action && -- 2.31.1
Powered by blists - more mailing lists