From nobody Tue May 7 11:02:06 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass header.i=@amazon.de; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=amazon.de ARC-Seal: i=1; a=rsa-sha256; t=1628773854; cv=none; d=zohomail.com; s=zohoarc; b=juwDsLDIHEt3ImunFhZkPCG3x08RvQbTIVT5spz9hrNVkw/HMXDpwON4dkXbu6WyseiSNmW21xz7GoGHtD8vNtbe/KLKBS6RaEiXNtgpRgvR2xxlpHJHNOd6ikTW++rgCIS4eewFCgkYOYMtz9/7qqAfSqkrN1mqodKvkFQEf8Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1628773854; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject; bh=zr1ZMwzvRcUxU3ViT69L/5vEXJCAOHMhOQBirbMXXDs=; b=Wpc4bfDrH3FH14W7Xe2f1ie600/UpFoZZMZm32q+9/yMRBJJSLGyWvN8mWIZoRmv03XsSt9ApEMYawIdPkVSwl0cpzszT+D83TR+LqPhm5RCLUaTrLgIkQaeyLZe7+ugmPlBGe6KgsigJ5ZN4lNmIYhnlbS069tNZcvx2HlkpTs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@amazon.de; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1628773854212200.58197739694867; Thu, 12 Aug 2021 06:10:54 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.166437.303756 (Exim 4.92) (envelope-from ) id 1mEATa-0002u9-Ft; Thu, 12 Aug 2021 13:10:26 +0000 Received: by outflank-mailman (output) from mailman id 166437.303756; Thu, 12 Aug 2021 13:10:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1mEATa-0002u2-Cw; Thu, 12 Aug 2021 13:10:26 +0000 Received: by outflank-mailman (input) for mailman id 166437; Thu, 12 Aug 2021 13:10:24 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1mEATY-0002tu-CM for xen-devel@lists.xenproject.org; Thu, 12 Aug 2021 13:10:24 +0000 Received: from smtp-fw-6001.amazon.com (unknown [52.95.48.154]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id b997d692-70ae-4df6-8504-bb17473f7e00; Thu, 12 Aug 2021 13:10:23 +0000 (UTC) Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2c-397e131e.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-6001.iad6.amazon.com with ESMTP; 12 Aug 2021 13:10:15 +0000 Received: from EX13D08EUC001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan3.pdx.amazon.com [10.236.137.198]) by email-inbound-relay-2c-397e131e.us-west-2.amazon.com (Postfix) with ESMTPS id 00A58A3AE5; Thu, 12 Aug 2021 13:10:13 +0000 (UTC) Received: from EX13MTAUEE002.ant.amazon.com (10.43.62.24) by EX13D08EUC001.ant.amazon.com (10.43.164.184) with Microsoft SMTP Server (TLS) id 15.0.1497.23; Thu, 12 Aug 2021 13:10:12 +0000 Received: from dev-dsk-mheyne-1b-c1524648.eu-west-1.amazon.com (10.15.60.66) by mail-relay.amazon.com (10.43.62.224) with Microsoft SMTP Server id 15.0.1497.23 via Frontend Transport; Thu, 12 Aug 2021 13:10:11 +0000 Received: by dev-dsk-mheyne-1b-c1524648.eu-west-1.amazon.com (Postfix, from userid 5466572) id D8E744100E; Thu, 12 Aug 2021 13:10:11 +0000 (UTC) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-Inumbo-ID: b997d692-70ae-4df6-8504-bb17473f7e00 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.de; i=@amazon.de; q=dns/txt; s=amazon201209; t=1628773823; x=1660309823; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=zr1ZMwzvRcUxU3ViT69L/5vEXJCAOHMhOQBirbMXXDs=; b=KRKO4RSH3NqXbuIs0pFPDDlZ6scuHCVfy0cgIfB6+FkDhP388n4fyOx/ W2D3IsUkYSrUnxx4kldgVs+P/stKm7UUefOthEX93szpDZVsoLkswUbsM D9wMS6ZkeR5ASce1XyZLukgEYZ2cQ6HAhnRjnt2qflq8bLgL//DymgN6j k=; X-IronPort-AV: E=Sophos;i="5.84,315,1620691200"; d="scan'208";a="133462453" From: Maximilian Heyne To: CC: Amit Shah , Maximilian Heyne , Boris Ostrovsky , Juergen Gross , Stefano Stabellini , Wei Liu , Thomas Gleixner , Jan Beulich , Malcolm Crossley , David Vrabel , Konrad Rzeszutek Wilk , , Subject: [PATCH v2] xen/events: Fix race in set_evtchn_to_irq Date: Thu, 12 Aug 2021 13:09:27 +0000 Message-ID: <20210812130930.127134-1-mheyne@amazon.de> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 Precedence: Bulk Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @amazon.de) X-ZM-MESSAGEID: 1628773855166100002 Content-Type: text/plain; charset="utf-8" There is a TOCTOU issue in set_evtchn_to_irq. Rows in the evtchn_to_irq mapping are lazily allocated in this function. The check whether the row is already present and the row initialization is not synchronized. Two threads can at the same time allocate a new row for evtchn_to_irq and add the irq mapping to the their newly allocated row. One thread will overwrite what the other has set for evtchn_to_irq[row] and therefore the irq mapping is lost. This will trigger a BUG_ON later in bind_evtchn_to_cpu: INFO: pci 0000:1a:15.4: [1d0f:8061] type 00 class 0x010802 INFO: nvme 0000:1a:12.1: enabling device (0000 -> 0002) INFO: nvme nvme77: 1/0/0 default/read/poll queues CRIT: kernel BUG at drivers/xen/events/events_base.c:427! WARN: invalid opcode: 0000 [#1] SMP NOPTI WARN: Workqueue: nvme-reset-wq nvme_reset_work [nvme] WARN: RIP: e030:bind_evtchn_to_cpu+0xc2/0xd0 WARN: Call Trace: WARN: set_affinity_irq+0x121/0x150 WARN: irq_do_set_affinity+0x37/0xe0 WARN: irq_setup_affinity+0xf6/0x170 WARN: irq_startup+0x64/0xe0 WARN: __setup_irq+0x69e/0x740 WARN: ? request_threaded_irq+0xad/0x160 WARN: request_threaded_irq+0xf5/0x160 WARN: ? nvme_timeout+0x2f0/0x2f0 [nvme] WARN: pci_request_irq+0xa9/0xf0 WARN: ? pci_alloc_irq_vectors_affinity+0xbb/0x130 WARN: queue_request_irq+0x4c/0x70 [nvme] WARN: nvme_reset_work+0x82d/0x1550 [nvme] WARN: ? check_preempt_wakeup+0x14f/0x230 WARN: ? check_preempt_curr+0x29/0x80 WARN: ? nvme_irq_check+0x30/0x30 [nvme] WARN: process_one_work+0x18e/0x3c0 WARN: worker_thread+0x30/0x3a0 WARN: ? process_one_work+0x3c0/0x3c0 WARN: kthread+0x113/0x130 WARN: ? kthread_park+0x90/0x90 WARN: ret_from_fork+0x3a/0x50 This patch sets evtchn_to_irq rows via a cmpxchg operation so that they will be set only once. The row is now cleared before writing it to evtchn_to_irq in order to not create a race once the row is visible for other threads. While at it, do not require the page to be zeroed, because it will be overwritten with -1's in clear_evtchn_to_irq_row anyway. Signed-off-by: Maximilian Heyne Fixes: d0b075ffeede ("xen/events: Refactor evtchn_to_irq array to be dynami= cally allocated") Reviewed-by: Boris Ostrovsky --- drivers/xen/events/events_base.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_b= ase.c index d7e361fb0548..0e44098f3977 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -198,12 +198,12 @@ static void disable_dynirq(struct irq_data *data); =20 static DEFINE_PER_CPU(unsigned int, irq_epoch); =20 -static void clear_evtchn_to_irq_row(unsigned row) +static void clear_evtchn_to_irq_row(int *evtchn_row) { unsigned col; =20 for (col =3D 0; col < EVTCHN_PER_ROW; col++) - WRITE_ONCE(evtchn_to_irq[row][col], -1); + WRITE_ONCE(evtchn_row[col], -1); } =20 static void clear_evtchn_to_irq_all(void) @@ -213,7 +213,7 @@ static void clear_evtchn_to_irq_all(void) for (row =3D 0; row < EVTCHN_ROW(xen_evtchn_max_channels()); row++) { if (evtchn_to_irq[row] =3D=3D NULL) continue; - clear_evtchn_to_irq_row(row); + clear_evtchn_to_irq_row(evtchn_to_irq[row]); } } =20 @@ -221,6 +221,7 @@ static int set_evtchn_to_irq(evtchn_port_t evtchn, unsi= gned int irq) { unsigned row; unsigned col; + int *evtchn_row; =20 if (evtchn >=3D xen_evtchn_max_channels()) return -EINVAL; @@ -233,11 +234,18 @@ static int set_evtchn_to_irq(evtchn_port_t evtchn, un= signed int irq) if (irq =3D=3D -1) return 0; =20 - evtchn_to_irq[row] =3D (int *)get_zeroed_page(GFP_KERNEL); - if (evtchn_to_irq[row] =3D=3D NULL) + evtchn_row =3D (int *) __get_free_pages(GFP_KERNEL, 0); + if (evtchn_row =3D=3D NULL) return -ENOMEM; =20 - clear_evtchn_to_irq_row(row); + clear_evtchn_to_irq_row(evtchn_row); + + /* + * We've prepared an empty row for the mapping. If a different + * thread was faster inserting it, we can drop ours. + */ + if (cmpxchg(&evtchn_to_irq[row], NULL, evtchn_row) !=3D NULL) + free_page((unsigned long) evtchn_row); } =20 WRITE_ONCE(evtchn_to_irq[row][col], irq); --=20 2.32.0 Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B Sitz: Berlin Ust-ID: DE 289 237 879