linux-kernel - [PATCH] irqdomain: Fix driver re-inserting failures when IRQs not being freed completely

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230720122429.4123447-1-zhanjie9@hisilicon.com>
Date:   Thu, 20 Jul 2023 20:24:29 +0800
From:   Jie Zhan <zhanjie9@...ilicon.com>
To:     <maz@...nel.org>, <tglx@...utronix.de>
CC:     <linux-kernel@...r.kernel.org>, <linuxarm@...wei.com>,
        <zhanjie9@...ilicon.com>, <prime.zeng@...ilicon.com>,
        <liyihang6@...ilicon.com>, <chenxiang66@...ilicon.com>,
        <shenyang39@...wei.com>, <qianweili@...wei.com>
Subject: [PATCH] irqdomain: Fix driver re-inserting failures when IRQs not being freed completely

Since commit 4615fbc3788d ("genirq/irqdomain: Don't try to free an
interrupt that has no mapping"), we have found failures when
re-inserting some specific drivers:

[root@...alhost ~]# rmmod hisi_sas_v3_hw
[root@...alhost ~]# modprobe hisi_sas_v3_hw
[ 1295.622525] hisi_sas_v3_hw: probe of 0000:30:04.0 failed with error -2

This comes from the case where some IRQs allocated from a low-level domain,
e.g. GIC ITS, are not freed completely, leaving some leaked. Thus, the next
driver insertion fails to get the same number of IRQs because some IRQs are
still occupied.

Free a contiguous group of IRQs in one go to fix this issue.

A previous discussion can be found at:
https://lore.kernel.org/lkml/3d3d0155e66429968cb4f6b4feeae4b3@kernel.org/
This solution was originally written by Marc Zyngier in the discussion, but
no code ends up upstreamed in that thread. Hopefully, this patch could get
some notice back.

Fixes: 4615fbc3788d ("genirq/irqdomain: Don't try to free an interrupt that has no mapping")
Signed-off-by: Jie Zhan <zhanjie9@...ilicon.com>
Reviewed-by: Liao Chang <liaochang1@...wei.com>
Signed-off-by: Zheng Zengkai <zhengzengkai@...wei.com>
---
 kernel/irq/irqdomain.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index f34760a1e222..f059e00dc827 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1445,13 +1445,24 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
 					   unsigned int nr_irqs)
 {
 	unsigned int i;
+	int n;
 
 	if (!domain->ops->free)
 		return;
 
 	for (i = 0; i < nr_irqs; i++) {
-		if (irq_domain_get_irq_data(domain, irq_base + i))
-			domain->ops->free(domain, irq_base + i, 1);
+		/* Find the largest possible span of IRQs to free in one go */
+		for (n = 0;
+			((i + n) < nr_irqs) &&
+			 (irq_domain_get_irq_data(domain, irq_base + i + n));
+			n++)
+			;
+
+		if (!n)
+			continue;
+
+		domain->ops->free(domain, irq_base + i, n);
+		i += n;
 	}
 }
 
-- 
2.30.0