linux-kernel - [PATCH 3/4] soc: qcom: smp2p: Add memory barrier for irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1657087331-32455-4-git-send-email-quic_clew@quicinc.com>
Date:   Tue, 5 Jul 2022 23:02:10 -0700
From:   Chris Lew <quic_clew@...cinc.com>
To:     <agross@...nel.org>, <bjorn.andersson@...aro.org>,
        <konrad.dybcio@...ainline.org>
CC:     <linux-arm-msm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <quic_clew@...cinc.com>
Subject: [PATCH 3/4] soc: qcom: smp2p: Add memory barrier for irq_pending

There is a very tight race where the irq_retrigger function is run
on one cpu and the actual retrigger softirq is running on a second
cpu. When this happens, there may be a chance that the second cpu
will not see the updated irq_pending value from first cpu.

Add a memory barrier to ensure that irq_pending is read correctly.

Signed-off-by: Chris Lew <quic_clew@...cinc.com>
---
 drivers/soc/qcom/smp2p.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c
index a94cddcb0298..a1ea5f55c228 100644
--- a/drivers/soc/qcom/smp2p.c
+++ b/drivers/soc/qcom/smp2p.c
@@ -249,6 +249,9 @@ static void qcom_smp2p_notify_in(struct qcom_smp2p *smp2p)
 
 		status = val ^ entry->last_value;
 		entry->last_value = val;
+
+		/* Ensure irq_pending is read correctly */
+		mb();
 		status |= *entry->irq_pending;
 
 		/* No changes of this entry? */
@@ -356,6 +359,11 @@ static int smp2p_retrigger_irq(struct irq_data *irqd)
 
 	set_bit(irq, entry->irq_pending);
 
+	/* Ensure irq_pending is visible to all cpus that retried interrupt
+	 * can run on
+	 */
+	mb();
+
 	return 0;
 }
 
-- 
2.7.4