Re: [PATCH] xen/events: Fix race in set_evtchn_to_irq

From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
To: Maximilian Heyne <mheyne@amazon.de>
Cc: Amit Shah <aams@amazon.de>, Juergen Gross <jgross@suse.com>,
	Stefano Stabellini <sstabellini@kernel.org>,
	Wei Liu <wei.liu@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	Jan Beulich <jbeulich@suse.com>,
	Malcolm Crossley <malcolm.crossley@citrix.com>,
	David Vrabel <david.vrabel@citrix.com>,
	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
	xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] xen/events: Fix race in set_evtchn_to_irq
Date: Wed, 11 Aug 2021 11:05:33 -0400	[thread overview]
Message-ID: <482af7c4-ad9e-6054-db45-ec05249a2517@oracle.com> (raw)
In-Reply-To: <20210811140806.75710-1-mheyne@amazon.de>

On 8/11/21 10:08 AM, Maximilian Heyne wrote:
>
> This patch sets evtchn_to_irq rows via a cmpxchg operation so that they
> will be set only once. Clearing the row was moved up before writing the
> row to evtchn_to_irq in order to not create a race once the row is
> visible for other threads. Accesses to the rows are now guarded by
> READ_ONCE and WRITE_ONCE just as for the columns in the data structure.

Is this last part really needed? We needed to do that for array elements to avoid an interrupt handler from seeing a partially updated entry but I am not sure I see how this can happen to the row pointer. The only place where it might be important is when we update the pointer to the new page but you are using cmpxchg there already.

>  
> -		evtchn_to_irq[row] = (int *)get_zeroed_page(GFP_KERNEL);
> -		if (evtchn_to_irq[row] == NULL)
> +		evtchn_row = (int *) get_zeroed_page(GFP_KERNEL);

Not directly related to this patch but I don't think we need to get a zeroed page --- we will initialize it to -1 immediately below.

-boris