All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.19 04/21] genirq/matrix: Prevent allocation counter corruption
Date: Sun,  2 May 2021 10:05:00 -0400	[thread overview]
Message-ID: <20210502140517.2719912-4-sashal@kernel.org> (raw)
In-Reply-To: <20210502140517.2719912-1-sashal@kernel.org>

From: Vitaly Kuznetsov <vkuznets@redhat.com>

[ Upstream commit c93a5e20c3c2dabef8ea360a3d3f18c6f68233ab ]

When irq_matrix_free() is called for an unallocated vector the
managed_allocated and total_allocated counters get out of sync with the
real state of the matrix. Later, when the last interrupt is freed, these
counters will underflow resulting in UINTMAX because the counters are
unsigned.

While this is certainly a problem of the calling code, this can be catched
in the allocator by checking the allocation bit for the to be freed vector
which simplifies debugging.

An example of the problem described above:
https://lore.kernel.org/lkml/20210318192819.636943062@linutronix.de/

Add the missing sanity check and emit a warning when it triggers.

Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210319111823.1105248-1-vkuznets@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/matrix.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
index 651a4ad6d711..8e586858bcf4 100644
--- a/kernel/irq/matrix.c
+++ b/kernel/irq/matrix.c
@@ -423,7 +423,9 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu,
 	if (WARN_ON_ONCE(bit < m->alloc_start || bit >= m->alloc_end))
 		return;
 
-	clear_bit(bit, cm->alloc_map);
+	if (WARN_ON_ONCE(!test_and_clear_bit(bit, cm->alloc_map)))
+		return;
+
 	cm->allocated--;
 	if(managed)
 		cm->managed_allocated--;
-- 
2.30.2


  parent reply	other threads:[~2021-05-02 14:08 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-02 14:04 [PATCH AUTOSEL 4.19 01/21] staging: wimax/i2400m: fix byte-order issue Sasha Levin
2021-05-02 14:04 ` [PATCH AUTOSEL 4.19 02/21] crypto: api - check for ERR pointers in crypto_destroy_tfm() Sasha Levin
2021-05-02 14:04 ` [PATCH AUTOSEL 4.19 03/21] usb: gadget: uvc: add bInterval checking for HS mode Sasha Levin
2021-05-02 14:05 ` Sasha Levin [this message]
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 05/21] usb: gadget: f_uac1: validate input parameters Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 06/21] usb: dwc3: gadget: Ignore EP queue requests during bus reset Sasha Levin
2021-05-10 12:03   ` Pavel Machek
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 07/21] usb: xhci: Fix port minor revision Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 08/21] PCI: PM: Do not read power state in pci_enable_device_flags() Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 09/21] x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 10/21] tee: optee: do not check memref size on return from Secure World Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 11/21] perf/arm_pmu_platform: Fix error handling Sasha Levin
2021-05-02 14:05   ` Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 12/21] usb: xhci-mtk: support quirk to disable usb2 lpm Sasha Levin
2021-05-02 14:05   ` Sasha Levin
2021-05-02 14:05   ` Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 13/21] xhci: check control context is valid before dereferencing it Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 14/21] xhci: fix potential array out of bounds with several interrupters Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 15/21] spi: dln2: Fix reference leak to master Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 16/21] spi: omap-100k: " Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 17/21] platform/x86: thinkpad_acpi: Correct thermal sensor allocation Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 18/21] intel_th: Consistency and off-by-one fix Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 19/21] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() Sasha Levin
2021-05-02 14:05   ` Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 20/21] crypto: omap-aes - Fix PM reference leak on omap-aes.c Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 21/21] btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210502140517.2719912-4-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=vkuznets@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.