Maximilian Heyne a905bd1c21 xen/events: Fix race in set_evtchn_to_irq ... [ Upstream commit 88ca2521bd5b4e8b83743c01a2d4cb09325b51e9 ] There is a TOCTOU issue in set_evtchn_to_irq. Rows in the evtchn_to_irq mapping are lazily allocated in this function. The check whether the row is already present and the row initialization is not synchronized. Two threads can at the same time allocate a new row for evtchn_to_irq and add the irq mapping to the their newly allocated row. One thread will overwrite what the other has set for evtchn_to_irq[row] and therefore the irq mapping is lost. This will trigger a BUG_ON later in bind_evtchn_to_cpu: INFO: pci 0000:1a:15.4: [1d0f:8061] type 00 class 0x010802 INFO: nvme 0000:1a:12.1: enabling device (0000 -> 0002) INFO: nvme nvme77: 1/0/0 default/read/poll queues CRIT: kernel BUG at drivers/xen/events/events_base.c:427! WARN: invalid opcode: 0000 [#1] SMP NOPTI WARN: Workqueue: nvme-reset-wq nvme_reset_work [nvme] WARN: RIP: e030:bind_evtchn_to_cpu+0xc2/0xd0 WARN: Call Trace: WARN: set_affinity_irq+0x121/0x150 WARN: irq_do_set_affinity+0x37/0xe0 WARN: irq_setup_affinity+0xf6/0x170 WARN: irq_startup+0x64/0xe0 WARN: __setup_irq+0x69e/0x740 WARN: ? request_threaded_irq+0xad/0x160 WARN: request_threaded_irq+0xf5/0x160 WARN: ? nvme_timeout+0x2f0/0x2f0 [nvme] WARN: pci_request_irq+0xa9/0xf0 WARN: ? pci_alloc_irq_vectors_affinity+0xbb/0x130 WARN: queue_request_irq+0x4c/0x70 [nvme] WARN: nvme_reset_work+0x82d/0x1550 [nvme] WARN: ? check_preempt_wakeup+0x14f/0x230 WARN: ? check_preempt_curr+0x29/0x80 WARN: ? nvme_irq_check+0x30/0x30 [nvme] WARN: process_one_work+0x18e/0x3c0 WARN: worker_thread+0x30/0x3a0 WARN: ? process_one_work+0x3c0/0x3c0 WARN: kthread+0x113/0x130 WARN: ? kthread_park+0x90/0x90 WARN: ret_from_fork+0x3a/0x50 This patch sets evtchn_to_irq rows via a cmpxchg operation so that they will be set only once. The row is now cleared before writing it to evtchn_to_irq in order to not create a race once the row is visible for other threads. While at it, do not require the page to be zeroed, because it will be overwritten with -1's in clear_evtchn_to_irq_row anyway. Signed-off-by: Maximilian Heyne <mheyne@amazon.de> Fixes: d0b075ffee ("xen/events: Refactor evtchn_to_irq array to be dynamically allocated") Link: https://lore.kernel.org/r/20210812130930.127134-1-mheyne@amazon.de Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-07-05 18:54:39 +02:00
..
events	xen/events: Fix race in set_evtchn_to_irq	2024-07-05 18:54:39 +02:00
xen-pciback	xen-pciback: reconfigure also from backend watch handler	2021-05-26 12:06:54 +02:00
xenbus	arm/xen: Don't probe xenbus as part of an early initcall	2021-02-17 11:02:21 +01:00
xenfs
acpi.c
arm-device.c
balloon.c
biomerge.c
cpu_hotplug.c
dbgp.c
efi.c
evtchn.c
features.c
gntalloc.c
gntdev-common.h
gntdev-dmabuf.c
gntdev-dmabuf.h
gntdev.c	xen/gntdev: fix gntdev_mmap() error exit path	2021-05-19 10:13:16 +02:00
grant-table.c
Kconfig	xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on MEMORY_HOTPLUG	2021-03-30 14:32:04 +02:00
Makefile
manage.c
mcelog.c
mem-reservation.c
pci.c
pcpu.c
platform-pci.c	xen: Fix event channel callback via INTX/GSI	2021-01-27 11:55:00 +01:00
privcmd-buf.c
privcmd.c	xen/privcmd: allow fetching resource sizes	2021-01-19 18:27:21 +01:00
privcmd.h
pvcalls-back.c
pvcalls-front.c
pvcalls-front.h
swiotlb-xen.c
sys-hypervisor.c
time.c
unpopulated-alloc.c	xen/unpopulated-alloc: fix error return code in fill_list()	2021-05-19 10:13:12 +02:00
xen-acpi-cpuhotplug.c
xen-acpi-memhotplug.c
xen-acpi-pad.c
xen-acpi-processor.c
xen-balloon.c
xen-front-pgdir-shbuf.c
xen-scsiback.c	xen-scsiback: don't "handle" error by BUG()	2021-02-23 15:53:24 +01:00
xen-stub.c
xlate_mmu.c