its_vlpi_prop_update() calls lpi_write_config() which obtains the
mapping information for a VLPI without lock held. So it could race
with its_vlpi_unmap().
Since all calls from its_irq_set_vcpu_affinity() require the same
lock to be held. So instead of peppering the locking all over the
place, we hoist the locking into its_irq_set_vcpu_affinity().
This bug was discovered using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.
Fixes: 015ec0386ab6 ("irqchip/gic-v3-its: Add VLPI configuration handling")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
---
v4: modified the commit msg.
Only compile-tested, no access to HW.
---
drivers/irqchip/irq-gic-v3-its.c | 65 +++++++++++++-------------------
1 file changed, 27 insertions(+), 38 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 40ebf1726393..f9e824ad1523 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1846,28 +1846,22 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
u32 event = its_get_event_id(d);
- int ret = 0;
if (!info->map)
return -EINVAL;
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
-
if (!its_dev->event_map.vm) {
struct its_vlpi_map *maps;
maps = kcalloc(its_dev->event_map.nr_lpis, sizeof(*maps),
GFP_ATOMIC);
- if (!maps) {
- ret = -ENOMEM;
- goto out;
- }
+ if (!maps)
+ return -ENOMEM;
its_dev->event_map.vm = info->map->vm;
its_dev->event_map.vlpi_maps = maps;
} else if (its_dev->event_map.vm != info->map->vm) {
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
/* Get our private copy of the mapping information */
@@ -1899,46 +1893,32 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
its_dev->event_map.nr_vlpis++;
}
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_get(struct irq_data *d, struct its_cmd_info *info)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
struct its_vlpi_map *map;
- int ret = 0;
-
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
map = get_vlpi_map(d);
- if (!its_dev->event_map.vm || !map) {
- ret = -EINVAL;
- goto out;
- }
+ if (!its_dev->event_map.vm || !map)
+ return -EINVAL;
/* Copy our mapping information to the incoming request */
*info->map = *map;
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_unmap(struct irq_data *d)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
u32 event = its_get_event_id(d);
- int ret = 0;
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
-
- if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d)) {
- ret = -EINVAL;
- goto out;
- }
+ if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d))
+ return -EINVAL;
/* Drop the virtual mapping */
its_send_discard(its_dev, event);
@@ -1962,9 +1942,7 @@ static int its_vlpi_unmap(struct irq_data *d)
kfree(its_dev->event_map.vlpi_maps);
}
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_prop_update(struct irq_data *d, struct its_cmd_info *info)
@@ -1987,29 +1965,40 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
struct its_cmd_info *info = vcpu_info;
+ int ret;
/* Need a v4 ITS */
if (!is_v4(its_dev->its))
return -EINVAL;
+ raw_spin_lock(&its_dev->event_map.vlpi_lock);
+
/* Unmap request? */
- if (!info)
- return its_vlpi_unmap(d);
+ if (!info) {
+ ret = its_vlpi_unmap(d);
+ goto out;
+ }
switch (info->cmd_type) {
case MAP_VLPI:
- return its_vlpi_map(d, info);
+ ret = its_vlpi_map(d, info);
+ break;
case GET_VLPI:
- return its_vlpi_get(d, info);
+ ret = its_vlpi_get(d, info);
+ break;
case PROP_UPDATE_VLPI:
case PROP_UPDATE_AND_INV_VLPI:
- return its_vlpi_prop_update(d, info);
+ ret = its_vlpi_prop_update(d, info);
+ break;
default:
- return -EINVAL;
+ ret = -EINVAL;
}
+out:
+ raw_spin_unlock(&its_dev->event_map.vlpi_lock);
+ return ret;
}
static struct irq_chip its_irq_chip = {
--
2.40.1On Fri, 31 May 2024 17:21:44 +0100,
Hagar Hemdan <hagarhem@amazon.com> wrote:
>
> its_vlpi_prop_update() calls lpi_write_config() which obtains the
> mapping information for a VLPI without lock held. So it could race
> with its_vlpi_unmap().
> Since all calls from its_irq_set_vcpu_affinity() require the same
> lock to be held. So instead of peppering the locking all over the
> place, we hoist the locking into its_irq_set_vcpu_affinity().
This looks odd. Maybe something along the lines of:
"Since all calls from its_irq_set_vcpu_affinity() require the same
lock to be held, hoist the locking there instead of peppering it over
the place."
>
> This bug was discovered using Coverity Static Analysis
> Security Testing (SAST) by Synopsys, Inc.
>
> Fixes: 015ec0386ab6 ("irqchip/gic-v3-its: Add VLPI configuration handling")
> Suggested-by: Marc Zyngier <maz@kernel.org>
> Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
With the above addressed,
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Thomas, can you please queue it at your earliest convenience?
Thanks,
M.
--
Without deviation from the norm, progress is not possible.
The following commit has been merged into the irq/urgent branch of tip:
Commit-ID: b97e8a2f7130a4b30d1502003095833d16c028b3
Gitweb: https://git.kernel.org/tip/b97e8a2f7130a4b30d1502003095833d16c028b3
Author: Hagar Hemdan <hagarhem@amazon.com>
AuthorDate: Fri, 31 May 2024 16:21:44
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitterDate: Mon, 03 Jun 2024 18:20:00 +02:00
irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
its_vlpi_prop_update() calls lpi_write_config() which obtains the
mapping information for a VLPI without lock held. So it could race
with its_vlpi_unmap().
Since all calls from its_irq_set_vcpu_affinity() require the same
lock to be held, hoist the locking there instead of sprinkling the
locking all over the place.
This bug was discovered using Coverity Static Analysis Security Testing
(SAST) by Synopsys, Inc.
[ tglx: Use guard() instead of goto ]
Fixes: 015ec0386ab6 ("irqchip/gic-v3-its: Add VLPI configuration handling")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20240531162144.28650-1-hagarhem@amazon.com
---
drivers/irqchip/irq-gic-v3-its.c | 44 ++++++++-----------------------
1 file changed, 12 insertions(+), 32 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 40ebf17..3c755d5 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1846,28 +1846,22 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
u32 event = its_get_event_id(d);
- int ret = 0;
if (!info->map)
return -EINVAL;
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
-
if (!its_dev->event_map.vm) {
struct its_vlpi_map *maps;
maps = kcalloc(its_dev->event_map.nr_lpis, sizeof(*maps),
GFP_ATOMIC);
- if (!maps) {
- ret = -ENOMEM;
- goto out;
- }
+ if (!maps)
+ return -ENOMEM;
its_dev->event_map.vm = info->map->vm;
its_dev->event_map.vlpi_maps = maps;
} else if (its_dev->event_map.vm != info->map->vm) {
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
/* Get our private copy of the mapping information */
@@ -1899,46 +1893,32 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
its_dev->event_map.nr_vlpis++;
}
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_get(struct irq_data *d, struct its_cmd_info *info)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
struct its_vlpi_map *map;
- int ret = 0;
-
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
map = get_vlpi_map(d);
- if (!its_dev->event_map.vm || !map) {
- ret = -EINVAL;
- goto out;
- }
+ if (!its_dev->event_map.vm || !map)
+ return -EINVAL;
/* Copy our mapping information to the incoming request */
*info->map = *map;
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_unmap(struct irq_data *d)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
u32 event = its_get_event_id(d);
- int ret = 0;
-
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
- if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d)) {
- ret = -EINVAL;
- goto out;
- }
+ if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d))
+ return -EINVAL;
/* Drop the virtual mapping */
its_send_discard(its_dev, event);
@@ -1962,9 +1942,7 @@ static int its_vlpi_unmap(struct irq_data *d)
kfree(its_dev->event_map.vlpi_maps);
}
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_prop_update(struct irq_data *d, struct its_cmd_info *info)
@@ -1992,6 +1970,8 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info)
if (!is_v4(its_dev->its))
return -EINVAL;
+ guard(raw_spinlock_irq)(&its_dev->event_map.vlpi_lock);
+
/* Unmap request? */
if (!info)
return its_vlpi_unmap(d);The following commit has been merged into the irq/urgent branch of tip:
Commit-ID: 8dd4302d37bb2fe842acb3be688d393254b4f126
Gitweb: https://git.kernel.org/tip/8dd4302d37bb2fe842acb3be688d393254b4f126
Author: Hagar Hemdan <hagarhem@amazon.com>
AuthorDate: Fri, 31 May 2024 16:21:44
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitterDate: Mon, 03 Jun 2024 14:19:42 +02:00
irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
its_vlpi_prop_update() calls lpi_write_config() which obtains the
mapping information for a VLPI without lock held. So it could race
with its_vlpi_unmap().
Since all calls from its_irq_set_vcpu_affinity() require the same
lock to be held, hoist the locking there instead of sprinkling the
locking all over the place.
This bug was discovered using Coverity Static Analysis Security Testing
(SAST) by Synopsys, Inc.
[ tglx: Use guard() instead of goto ]
Fixes: 015ec0386ab6 ("irqchip/gic-v3-its: Add VLPI configuration handling")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20240531162144.28650-1-hagarhem@amazon.com
---
drivers/irqchip/irq-gic-v3-its.c | 44 ++++++++-----------------------
1 file changed, 12 insertions(+), 32 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 40ebf17..c696ac9 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1846,28 +1846,22 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
u32 event = its_get_event_id(d);
- int ret = 0;
if (!info->map)
return -EINVAL;
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
-
if (!its_dev->event_map.vm) {
struct its_vlpi_map *maps;
maps = kcalloc(its_dev->event_map.nr_lpis, sizeof(*maps),
GFP_ATOMIC);
- if (!maps) {
- ret = -ENOMEM;
- goto out;
- }
+ if (!maps)
+ return -ENOMEM;
its_dev->event_map.vm = info->map->vm;
its_dev->event_map.vlpi_maps = maps;
} else if (its_dev->event_map.vm != info->map->vm) {
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
/* Get our private copy of the mapping information */
@@ -1899,46 +1893,32 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
its_dev->event_map.nr_vlpis++;
}
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_get(struct irq_data *d, struct its_cmd_info *info)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
struct its_vlpi_map *map;
- int ret = 0;
-
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
map = get_vlpi_map(d);
- if (!its_dev->event_map.vm || !map) {
- ret = -EINVAL;
- goto out;
- }
+ if (!its_dev->event_map.vm || !map)
+ return -EINVAL;
/* Copy our mapping information to the incoming request */
*info->map = *map;
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_unmap(struct irq_data *d)
{
struct its_device *its_dev = irq_data_get_irq_chip_data(d);
u32 event = its_get_event_id(d);
- int ret = 0;
-
- raw_spin_lock(&its_dev->event_map.vlpi_lock);
- if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d)) {
- ret = -EINVAL;
- goto out;
- }
+ if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d))
+ return -EINVAL;
/* Drop the virtual mapping */
its_send_discard(its_dev, event);
@@ -1962,9 +1942,7 @@ static int its_vlpi_unmap(struct irq_data *d)
kfree(its_dev->event_map.vlpi_maps);
}
-out:
- raw_spin_unlock(&its_dev->event_map.vlpi_lock);
- return ret;
+ return 0;
}
static int its_vlpi_prop_update(struct irq_data *d, struct its_cmd_info *info)
@@ -1992,6 +1970,8 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info)
if (!is_v4(its_dev->its))
return -EINVAL;
+ guard(raw_spinlock_irq, &its_dev->event_map.vlpi_lock);
+
/* Unmap request? */
if (!info)
return its_vlpi_unmap(d);On Mon, 03 Jun 2024 13:25:06 +0100,
"tip-bot2 for Hagar Hemdan" <tip-bot2@linutronix.de> wrote:
>
> The following commit has been merged into the irq/urgent branch of tip:
>
> Commit-ID: 8dd4302d37bb2fe842acb3be688d393254b4f126
> Gitweb: https://git.kernel.org/tip/8dd4302d37bb2fe842acb3be688d393254b4f126
> Author: Hagar Hemdan <hagarhem@amazon.com>
> AuthorDate: Fri, 31 May 2024 16:21:44
> Committer: Thomas Gleixner <tglx@linutronix.de>
> CommitterDate: Mon, 03 Jun 2024 14:19:42 +02:00
>
> irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
>
> its_vlpi_prop_update() calls lpi_write_config() which obtains the
> mapping information for a VLPI without lock held. So it could race
> with its_vlpi_unmap().
>
> Since all calls from its_irq_set_vcpu_affinity() require the same
> lock to be held, hoist the locking there instead of sprinkling the
> locking all over the place.
>
> This bug was discovered using Coverity Static Analysis Security Testing
> (SAST) by Synopsys, Inc.
>
> [ tglx: Use guard() instead of goto ]
Good call. Except that...
>
> Fixes: 015ec0386ab6 ("irqchip/gic-v3-its: Add VLPI configuration handling")
> Suggested-by: Marc Zyngier <maz@kernel.org>
> Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: stable@vger.kernel.org
> Reviewed-by: Marc Zyngier <maz@kernel.org>
> Link: https://lore.kernel.org/r/20240531162144.28650-1-hagarhem@amazon.com
> ---
> drivers/irqchip/irq-gic-v3-its.c | 44 ++++++++-----------------------
> 1 file changed, 12 insertions(+), 32 deletions(-)
>
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 40ebf17..c696ac9 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
[...]
> @@ -1992,6 +1970,8 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info)
> if (!is_v4(its_dev->its))
> return -EINVAL;
>
> + guard(raw_spinlock_irq, &its_dev->event_map.vlpi_lock);
> +
I don't think this compiles as is, due to the funky syntax required.
Thanks,
M.
--
Without deviation from the norm, progress is not possible.
On Mon, Jun 03 2024 at 17:01, Marc Zyngier wrote: > On Mon, 03 Jun 2024 13:25:06 +0100, >> @@ -1992,6 +1970,8 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info) >> if (!is_v4(its_dev->its)) >> return -EINVAL; >> >> + guard(raw_spinlock_irq, &its_dev->event_map.vlpi_lock); >> + > > I don't think this compiles as is, due to the funky syntax required. Stupid me. I obviously compiled the wrong config to validate... Fixed now.
… > [ tglx: Use guard() instead of goto ] … > +++ b/drivers/irqchip/irq-gic-v3-its.c … > @@ -1992,6 +1970,8 @@ static int its_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu_info) > if (!is_v4(its_dev->its)) > return -EINVAL; > > + guard(raw_spinlock_irq, &its_dev->event_map.vlpi_lock); > + > /* Unmap request? */ > if (!info) > return its_vlpi_unmap(d); I found a similar guard() call in the implementation of the function “task_state_match”. https://elixir.bootlin.com/linux/v6.10-rc2/source/kernel/sched/core.c#L2264 A slightly different combination of parentheses is applied there. How do you think about to apply the following code variant accordingly? + guard(raw_spinlock_irq)(&its_dev->event_map.vlpi_lock); Regards, Markus
© 2016 - 2025 Red Hat, Inc.