linux-kernel - [PATCH] genirq: procfs: Make smp_affinity read-only for interrupts marked with IRQD_AFFINITY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240820020904.2514189-1-jeff.xie@linux.dev>
Date: Tue, 20 Aug 2024 10:09:04 +0800
From: Jeff Xie <jeff.xie@...ux.dev>
To: tglx@...utronix.de
Cc: linux-kernel@...r.kernel.org,
	xiehuan09@...il.com,
	Jeff Xie <jeff.xie@...ux.dev>
Subject: [PATCH] genirq: procfs: Make smp_affinity read-only for interrupts marked with IRQD_AFFINITY_MANAGED flag

Currently, due to the interrupt subsystem introduced this commit 9c2555835bb3
("genirq: Introduce IRQD_AFFINITY_MANAGED flag"), an error is reported when a
system administrator modifies the smp_affinity for the virtio_blk driver.
For example:

jeff-labs:/proc/irq/26 # echo 2 > ./smp_affinity
-bash: echo: write error: Input/output error

However, checking the permissions of smp_affinity/smp_affinity_list shows that
they are set to rw. System administrators are strongly complaining about this issue.

jeff-labs:/proc/irq/26 # ls -l
total 0
-r--r--r-- 1 root root 0 Aug 20 01:32 affinity_hint
-r--r--r-- 1 root root 0 Aug 20 01:32 effective_affinity
-r--r--r-- 1 root root 0 Aug 20 01:32 effective_affinity_list
-r--r--r-- 1 root root 0 Aug 20 01:32 node
-rw-r--r-- 1 root root 0 Aug 20 01:32 smp_affinity
-rw-r--r-- 1 root root 0 Aug 20 01:32 smp_affinity_list
-r--r--r-- 1 root root 0 Aug 20 01:32 spurious
dr-xr-xr-x 2 root root 0 Aug 20 01:32 virtio3-req.0

Therefore, the permissions of smp_affinity/smp_affinity_list should be changed to read-only.

Signed-off-by: Jeff Xie <jeff.xie@...ux.dev>
---
 kernel/irq/proc.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 8cccdf40725a..4a7d572b7a8c 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -363,7 +363,11 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
 
 #ifdef CONFIG_SMP
 	/* create /proc/irq/<irq>/smp_affinity */
-	proc_create_data("smp_affinity", 0644, desc->dir,
+	if (unlikely(irqd_affinity_is_managed(&desc->irq_data)))
+		proc_create_data("smp_affinity", 0444, desc->dir,
+			 &irq_affinity_proc_ops, irqp);
+	else
+		proc_create_data("smp_affinity", 0644, desc->dir,
 			 &irq_affinity_proc_ops, irqp);
 
 	/* create /proc/irq/<irq>/affinity_hint */
@@ -371,7 +375,11 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
 			irq_affinity_hint_proc_show, irqp);
 
 	/* create /proc/irq/<irq>/smp_affinity_list */
-	proc_create_data("smp_affinity_list", 0644, desc->dir,
+	if (unlikely(irqd_affinity_is_managed(&desc->irq_data)))
+		proc_create_data("smp_affinity_list", 0444, desc->dir,
+			 &irq_affinity_list_proc_ops, irqp);
+	else
+		proc_create_data("smp_affinity_list", 0644, desc->dir,
 			 &irq_affinity_list_proc_ops, irqp);
 
 	proc_create_single_data("node", 0444, desc->dir, irq_node_proc_show,
--
2.34.1