linux-kernel - RE: [PATCH 2/7] vfio/pci: Lock external INTx masking ops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BN9PR11MB527641E05DF98A579889B5788C272@BN9PR11MB5276.namprd11.prod.outlook.com>
Date: Fri, 8 Mar 2024 07:17:12 +0000
From: "Tian, Kevin" <kevin.tian@...el.com>
To: Alex Williamson <alex.williamson@...hat.com>
CC: "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "eric.auger@...hat.com"
	<eric.auger@...hat.com>, "clg@...hat.com" <clg@...hat.com>, "Chatre,
 Reinette" <reinette.chatre@...el.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: RE: [PATCH 2/7] vfio/pci: Lock external INTx masking ops

> From: Alex Williamson <alex.williamson@...hat.com>
> Sent: Friday, March 8, 2024 4:21 AM
> 
> On Thu, 7 Mar 2024 08:37:53 +0000
> "Tian, Kevin" <kevin.tian@...el.com> wrote:
> 
> > > From: Alex Williamson <alex.williamson@...hat.com>
> > > Sent: Thursday, March 7, 2024 5:15 AM
> > >
> > > Mask operations through config space changes to DisINTx may race INTx
> > > configuration changes via ioctl.  Create wrappers that add locking for
> > > paths outside of the core interrupt code.
> > >
> > > In particular, irq_type is updated holding igate, therefore testing
> > > is_intx() requires holding igate.  For example clearing DisINTx from
> > > config space can otherwise race changes of the interrupt configuration.
> > >
> >
> > Looks the suspend path still checks irq_type w/o holding igate:
> >
> > 	vdev->pm_intx_masked = ((vdev->irq_type ==
> VFIO_PCI_INTX_IRQ_INDEX) &&
> > 				 vfio_pci_intx_mask(vdev));
> >
> > Is it with assumption that no change of configuration is possible at
> > that point?
> 
> Yes, I believe this is relatively safe because userspace is frozen at
> this point.  That's not however to claim that irq_type is absolutely
> used consistently after this series.  I just didn't see the other
> violations rise to the same level as the fixes in this series and
> wanted to avoid the distraction.  I've stashed a number of patches that
> I'd eventually like to post as follow-ups to this series.  Thanks,
> 

Reviewed-by: Kevin Tian <kevin.tian@...el.com>