lkml.org 
[lkml]   [2020]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 71/85] xen/events: fix race in evtchn_fifo_unmask()
    Date
    From: Juergen Gross <jgross@suse.com>

    commit f01337197419b7e8a492e83089552b77d3b5fb90 upstream.

    Unmasking a fifo event channel can result in unmasking it twice, once
    directly in the kernel and once via a hypercall in case the event was
    pending.

    Fix that by doing the local unmask only if the event is not pending.

    This is part of XSA-332.

    Cc: stable@vger.kernel.org
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/xen/events/events_fifo.c | 13 +++++++++----
    1 file changed, 9 insertions(+), 4 deletions(-)

    --- a/drivers/xen/events/events_fifo.c
    +++ b/drivers/xen/events/events_fifo.c
    @@ -227,19 +227,25 @@ static bool evtchn_fifo_is_masked(unsign
    return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
    }
    /*
    - * Clear MASKED, spinning if BUSY is set.
    + * Clear MASKED if not PENDING, spinning if BUSY is set.
    + * Return true if mask was cleared.
    */
    -static void clear_masked(volatile event_word_t *word)
    +static bool clear_masked_cond(volatile event_word_t *word)
    {
    event_word_t new, old, w;

    w = *word;

    do {
    + if (w & (1 << EVTCHN_FIFO_PENDING))
    + return false;
    +
    old = w & ~(1 << EVTCHN_FIFO_BUSY);
    new = old & ~(1 << EVTCHN_FIFO_MASKED);
    w = sync_cmpxchg(word, old, new);
    } while (w != old);
    +
    + return true;
    }

    static void evtchn_fifo_unmask(unsigned port)
    @@ -248,8 +254,7 @@ static void evtchn_fifo_unmask(unsigned

    BUG_ON(!irqs_disabled());

    - clear_masked(word);
    - if (evtchn_fifo_is_pending(port)) {
    + if (!clear_masked_cond(word)) {
    struct evtchn_unmask unmask = { .port = port };
    (void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
    }

    \
     
     \ /
      Last update: 2020-11-17 15:10    [W:3.211 / U:0.480 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site