linux-kernel - Re: [PATCH] irqdomain: Fix irqdomain->revmap race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 19 Dec 2022 15:35:33 +0100
From:   Johan Hovold <johan@...nel.org>
To:     Mark-PK Tsai <mark-pk.tsai@...iatek.com>
Cc:     Marc Zyngier <maz@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Matthias Brugger <matthias.bgg@...il.com>,
        yj.chiang@...iatek.com, phil.chang@...iatek.com,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-mediatek@...ts.infradead.org
Subject: Re: [PATCH] irqdomain: Fix irqdomain->revmap race

On Mon, Dec 19, 2022 at 09:06:15PM +0800, Mark-PK Tsai wrote:
> The irqdomain->revmap(_tree) of a shared irq can be race updated
> as following, which result in an unexpected irq mapping:
> 
> ---------------------------------------------------------------
> (2 threads parse the same hwirq fwspec in the same time.)
> 
> Thread A 			Thread B
> irq_create_fwspec_mapping
> irq_find_mapping						Thread A: virq = 0, alloc a new irq_desc
> 				irq_create_fwspec_mapping
> 				irq_find_mapping		Thread B: virq = 0, alloc a new irq_desc
> irq_domain_alloc_irqs
> irq_domain_insert_irq						domain->revmap[hwirq] = irq_data(virq x)
> 				irq_domain_alloc_irqs
> 				irq_domain_insert_irq		domain->revmap[hwirq] = irq_data(virq x + 1)
> 
> virq = x			virq = x + 1
> ---------------------------------------------------------------
> 
> The virq x can't work because the revmap[hwirq] was
> overridden by thread B.
> 
> It seems both hierarchy and non-hierarchy irq domain have the same
> problem because the code from irq_find_mapping to revmap update are
> not protected by a same lock.
> 
> Do you have any suggestion about how to fix it properly?

This is being fixed here:

	https://lore.kernel.org/lkml/20221209140150.1453-1-johan+linaro@kernel.org/

Johan