From nobody Fri Apr 26 10:24:04 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1595436813; cv=none; d=zohomail.com; s=zohoarc; b=Y2R+zJFkAtG8v/jPSmI2d6CI/MoqYBLIpKXaUmvWllmYKV0svVRGCHvJP3KnJpJetY3/RpIzhysj159/LCEjQzBHzN73qBZuzJKBm10thLXyub6M/eYh7ylWUPGgPRwvUmzkdwOXfNHeiyH/X5zQgY6t3hx6Ckf0UaRM+ncg8kU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595436813; h=Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:Message-ID:Sender:Subject:To; bh=kFC2CwkBpCIOOYAIewqEA21Bqic7EPnr09gGzUQ+zKo=; b=gDwTMnHw3KLo+H5O8T4nBLUhVuCIK5HJNMArdDLUCF1Rr0N4Zq6VtOqZTgf4V0J7wqkg5UDBCJIiGaWPgdRE+rUbTWbVP9Oy5bNTcmU46eGeJGqzWgLDSAJiN19nhHO67lg9H7sNHXiB3g73+mvrdT6hh0lIKLDIZ/SEAT2VFTk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1595436813671105.24434435886053; Wed, 22 Jul 2020 09:53:33 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jyHzQ-00058H-NC; Wed, 22 Jul 2020 16:53:08 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jyHzO-00058B-Tq for xen-devel@lists.xenproject.org; Wed, 22 Jul 2020 16:53:06 +0000 Received: from mail.xenproject.org (unknown [104.130.215.37]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id cfeed6d0-cc3b-11ea-a1e5-12813bfff9fa; Wed, 22 Jul 2020 16:53:05 +0000 (UTC) Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jyHzM-0003r7-Pe; Wed, 22 Jul 2020 16:53:04 +0000 Received: from 54-240-197-227.amazon.com ([54.240.197.227] helo=ufe34d9ed68d054.ant.amazon.com) by xenbits.xenproject.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jyHzM-0007vp-Cq; Wed, 22 Jul 2020 16:53:04 +0000 X-Inumbo-ID: cfeed6d0-cc3b-11ea-a1e5-12813bfff9fa DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xen.org; s=20200302mail; h=Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=kFC2CwkBpCIOOYAIewqEA21Bqic7EPnr09gGzUQ+zKo=; b=zh5b3Eh5H7mVm64GK0S+/nExUZ p0SoLxv6JEug33D7AnCmJEEZOX7eefsqbVkOS8bZl8Mo+HFfZcMvmhnsJnVHhOG5dgpL6bOTHBe// T0rmURRS5NwqSU//5+82AKQ60uNCEDS3yRzQpfRl3QsmmH2DnZ2KhJYYHCV4pffpUR5s=; From: Julien Grall To: xen-devel@lists.xenproject.org Subject: [PATCH] xen/x86: irq: Avoid a TOCTOU race in pirq_spin_lock_irq_desc() Date: Wed, 22 Jul 2020 17:53:00 +0100 Message-Id: <20200722165300.22655-1-julien@xen.org> X-Mailer: git-send-email 2.17.1 X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: julien@xen.org, Wei Liu , Andrew Cooper , Julien Grall , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Julien Grall Even if we assigned pirq->arch.irq to a variable, a compile is still allowed to read pirq->arch.irq multiple time. This means that the value checked may be different from the value used to get the desc. Force the compiler to only do one read access by using read_atomic(). Signed-off-by: Julien Grall --- xen/arch/x86/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index a69937c840b9..25f2eb611692 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -1187,7 +1187,7 @@ struct irq_desc *pirq_spin_lock_irq_desc( =20 for ( ; ; ) { - int irq =3D pirq->arch.irq; + int irq =3D read_atomic(&pirq->arch.irq); =20 if ( irq <=3D 0 ) return NULL; --=20 2.17.1