linux-kernel - Re: [PATCH 4/7] vfio/pci: Create persistent INTx handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b57b6a87-9805-4643-a56c-e866c8a5b1b5@intel.com>
Date: Fri, 8 Mar 2024 12:46:18 -0800
From: Reinette Chatre <reinette.chatre@...el.com>
To: Alex Williamson <alex.williamson@...hat.com>
CC: <kvm@...r.kernel.org>, <eric.auger@...hat.com>, <clg@...hat.com>,
	<linux-kernel@...r.kernel.org>, <kevin.tian@...el.com>
Subject: Re: [PATCH 4/7] vfio/pci: Create persistent INTx handler

Hi Alex,

On 3/6/2024 1:14 PM, Alex Williamson wrote:
> A vulnerability exists where the eventfd for INTx signaling can be
> deconfigured, which unregisters the IRQ handler but still allows
> eventfds to be signaled with a NULL context through the SET_IRQS ioctl
> or through unmask irqfd if the device interrupt is pending.
> 
> Ideally this could be solved with some additional locking; the igate
> mutex serializes the ioctl and config space accesses, and the interrupt
> handler is unregistered relative to the trigger, but the irqfd path
> runs asynchronous to those.  The igate mutex cannot be acquired from the
> atomic context of the eventfd wake function.  Disabling the irqfd
> relative to the eventfd registration is potentially incompatible with
> existing userspace.
> 
> As a result, the solution implemented here moves configuration of the
> INTx interrupt handler to track the lifetime of the INTx context object
> and irq_type configuration, rather than registration of a particular
> trigger eventfd.  Synchronization is added between the ioctl path and
> eventfd_signal() wrapper such that the eventfd trigger can be
> dynamically updated relative to in-flight interrupts or irqfd callbacks.
> 
> Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
> Reported-by: Reinette Chatre <reinette.chatre@...el.com>
> Signed-off-by: Alex Williamson <alex.williamson@...hat.com>
> ---

Thank you very much.

Reviewed-by: Reinette Chatre <reinette.chatre@...el.com>

Reinette