linux-kernel - [PATCH] genirq/proc: fix race in show_irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251028090408.76331-1-songmuchun@bytedance.com>
Date: Tue, 28 Oct 2025 17:04:08 +0800
From: Muchun Song <songmuchun@...edance.com>
To: tglx@...utronix.de,
	linux-kernel@...r.kernel.org
Cc: muchun.song@...ux.dev,
	Muchun Song <songmuchun@...edance.com>
Subject: [PATCH] genirq/proc: fix race in show_irq_affinity()

Reading /proc/irq/N/smp_affinity* races with irq_set_affinity() and
irq_move_masked_irq(), leading to old or torn output for users.

We hit a real-world issue: after a user writes a new CPU mask to
/proc/irq/N/affinity*, the syscall returns success, yet a subsequent
read of the same file immediately returns a value different from
what was just written—much to the user’s surprise. Root-causing
showed that a race between show_irq_affinity() and
irq_move_masked_irq() lets the read observe a transient, inconsistent
affinity mask. struct irq_desc is supposed to be accessed under the
desc->lock, it seems that show_irq_affinity() forgets that, so fix it.

Signed-off-by: Muchun Song <songmuchun@...edance.com>
---
 kernel/irq/proc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 8e29809de38d..d8979d46abbd 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -48,6 +48,8 @@ static int show_irq_affinity(int type, struct seq_file *m)
 	struct irq_desc *desc = irq_to_desc((long)m->private);
 	const struct cpumask *mask;

+	guard(raw_spinlock_irq)(&desc->lock);
+
 	switch (type) {
 	case AFFINITY:
 	case AFFINITY_LIST:
-- 
2.20.1