From: Marc Zyngier <maz@kernel.org>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: LKML <linux-kernel@vger.kernel.org>,
x86@kernel.org, Bjorn Helgaas <bhelgaas@google.com>,
linux-pci@vger.kernel.org, Keith Busch <kbusch@kernel.org>,
Kuppuswamy Sathyanarayanan
<sathyanarayanan.kuppuswamy@linux.intel.com>
Subject: Re: [patch 2/7] genirq: Add protection against unsafe usage of generic_handle_irq()
Date: Fri, 06 Mar 2020 13:36:35 +0000 [thread overview]
Message-ID: <664b3a85c46aff34ae89548e118c1bd8@kernel.org> (raw)
In-Reply-To: <20200306130623.590923677@linutronix.de>
On 2020-03-06 13:03, Thomas Gleixner wrote:
> In general calling generic_handle_irq() with interrupts disabled from
> non
> interrupt context is harmless. For some interrupt controllers like the
> x86
> trainwrecks this is outright dangerous as it might corrupt state if an
> interrupt affinity change is pending.
>
> Add infrastructure which allows to mark interrupts as unsafe and catch
> such
> usage in generic_handle_irq().
>
> Reported-by: sathyanarayanan.kuppuswamy@linux.intel.com
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> ---
> include/linux/irq.h | 13 +++++++++++++
> kernel/irq/internals.h | 8 ++++++++
> kernel/irq/irqdesc.c | 6 ++++++
> kernel/irq/resend.c | 5 +++--
> 4 files changed, 30 insertions(+), 2 deletions(-)
>
> --- a/include/linux/irq.h
> +++ b/include/linux/irq.h
> @@ -211,6 +211,8 @@ struct irq_data {
> * IRQD_CAN_RESERVE - Can use reservation mode
> * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change
> * required
> + * IRQD_HANDLE_ENFORCE_IRQCTX - Enforce that handle_irq_*() is only
> invoked
> + * from actual interrupt context.
> */
> enum {
> IRQD_TRIGGER_MASK = 0xf,
> @@ -234,6 +236,7 @@ enum {
> IRQD_DEFAULT_TRIGGER_SET = (1 << 25),
> IRQD_CAN_RESERVE = (1 << 26),
> IRQD_MSI_NOMASK_QUIRK = (1 << 27),
> + IRQD_HANDLE_ENFORCE_IRQCTX = (1 << 28),
> };
>
> #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common,
> state_use_accessors)
> @@ -303,6 +306,16 @@ static inline bool irqd_is_single_target
> return __irqd_to_state(d) & IRQD_SINGLE_TARGET;
> }
>
> +static inline void irqd_set_handle_enforce_irqctx(struct irq_data *d)
> +{
> + __irqd_to_state(d) |= IRQD_HANDLE_ENFORCE_IRQCTX;
> +}
> +
> +static inline bool irqd_is_handle_enforce_irqctx(struct irq_data *d)
> +{
> + return __irqd_to_state(d) & IRQD_HANDLE_ENFORCE_IRQCTX;
> +}
> +
> static inline bool irqd_is_wakeup_set(struct irq_data *d)
> {
> return __irqd_to_state(d) & IRQD_WAKEUP_STATE;
> --- a/kernel/irq/internals.h
> +++ b/kernel/irq/internals.h
> @@ -425,6 +425,10 @@ static inline struct cpumask *irq_desc_g
> {
> return desc->pending_mask;
> }
> +static inline bool handle_enforce_irqctx(struct irq_data *data)
> +{
> + return irqd_is_handle_enforce_irqctx(data);
> +}
> bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear);
> #else /* CONFIG_GENERIC_PENDING_IRQ */
> static inline bool irq_can_move_pcntxt(struct irq_data *data)
> @@ -451,6 +455,10 @@ static inline bool irq_fixup_move_pendin
> {
> return false;
> }
> +static inline bool handle_enforce_irqctx(struct irq_data *data)
> +{
> + return false;
> +}
> #endif /* !CONFIG_GENERIC_PENDING_IRQ */
>
> #if !defined(CONFIG_IRQ_DOMAIN) ||
> !defined(CONFIG_IRQ_DOMAIN_HIERARCHY)
> --- a/kernel/irq/irqdesc.c
> +++ b/kernel/irq/irqdesc.c
> @@ -638,9 +638,15 @@ void irq_init_desc(unsigned int irq)
> int generic_handle_irq(unsigned int irq)
> {
> struct irq_desc *desc = irq_to_desc(irq);
> + struct irq_data *data;
>
> if (!desc)
> return -EINVAL;
> +
> + data = irq_desc_get_irq_data(desc);
> + if (WARN_ON_ONCE(!in_irq() && handle_enforce_irqctx(data)))
> + return -EPERM;
It is a bit sad that there are only *two* users in the tree that
actually check the return value of generic_handle_irq(). Thankfully,
the WARN_ON should wake people up.
> +
> generic_handle_irq_desc(desc);
> return 0;
> }
> --- a/kernel/irq/resend.c
> +++ b/kernel/irq/resend.c
> @@ -72,8 +72,9 @@ void check_irq_resend(struct irq_desc *d
> desc->istate &= ~IRQS_PENDING;
> desc->istate |= IRQS_REPLAY;
>
> - if (!desc->irq_data.chip->irq_retrigger ||
> - !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
> + if ((!desc->irq_data.chip->irq_retrigger ||
> + !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) &&
> + !handle_enforce_irqctx(&desc->irq_data)) {
> #ifdef CONFIG_HARDIRQS_SW_RESEND
> unsigned int irq = irq_desc_get_irq(desc);
Acked-by: Marc Zyngier <maz@kernel.org>
M.
--
Jazz is not dead. It just smells funny...
next prev parent reply other threads:[~2020-03-06 13:36 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-06 13:03 [patch 0/7] genirq/PCI: Sanitize interrupt injection Thomas Gleixner
2020-03-06 13:03 ` [patch 1/7] genirq/debugfs: Add missing sanity checks to " Thomas Gleixner
2020-03-06 13:15 ` Marc Zyngier
2020-03-06 13:03 ` [patch 2/7] genirq: Add protection against unsafe usage of generic_handle_irq() Thomas Gleixner
2020-03-06 13:36 ` Marc Zyngier [this message]
2020-03-06 13:03 ` [patch 3/7] x86/apic/vector: Force interupt handler invocation to irq context Thomas Gleixner
2020-03-06 13:03 ` [patch 4/7] genirq: Add return value to check_irq_resend() Thomas Gleixner
2020-03-06 13:44 ` Marc Zyngier
2020-03-06 13:03 ` [patch 5/7] genirq: Sanitize state handling in check_irq_resend() Thomas Gleixner
2020-03-06 13:46 ` Marc Zyngier
2020-03-06 13:03 ` [patch 6/7] genirq: Provide interrupt injection mechanism Thomas Gleixner
2020-03-06 13:52 ` Marc Zyngier
2020-03-06 18:34 ` Kuppuswamy Sathyanarayanan
2020-03-06 13:03 ` [patch 7/7] PCI/AER: Fix the broken interrupt injection Thomas Gleixner
2020-03-06 18:32 ` Kuppuswamy Sathyanarayanan
2020-03-06 19:29 ` Kuppuswamy Sathyanarayanan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=664b3a85c46aff34ae89548e118c1bd8@kernel.org \
--to=maz@kernel.org \
--cc=bhelgaas@google.com \
--cc=kbusch@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).