Commit 3424b485 authored by Marc Zyngier's avatar Marc Zyngier Committed by Zheng Qixing
Browse files

irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs 

mainline inclusion
from mainline-v6.12-rc6
commit e6c24e2d05bb05de96ffb9bdb0ee62d20ad526f8
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWE
CVE: CVE-2024-50192

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6c24e2d05bb05de96ffb9bdb0ee62d20ad526f8



--------------------

Zenghui points out that a recent change to the way set_affinity is
handled for VPEs has the potential to return an error if the VPE
hasn't been mapped yet (because the guest hasn't emited a MAPTI
command yet), affecting GICv4.0 implementations that rely on the
ITSList feature.

Fix this by making the set_affinity succeed in this case, and
return early, without trying to touch the HW.

Fixes: 1442ee0011983 ("irqchip/gic-v4: Don't allow a VMOVP on a dying VPE")
Reported-by: default avatarZenghui Yu <yuzenghui@huawei.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reviewed-by: default avatarZenghui Yu <yuzenghui@huawei.com>
Link: https://lore.kernel.org/all/20241027102220.1858558-1-maz@kernel.org
Link: https://lore.kernel.org/r/aab45cd3-e5ca-58cf-e081-e32a17f5b4e7@huawei.com


Signed-off-by: default avatarZheng Qixing <zhengqixing@huawei.com>
parent aa6b9c91

drivers/irqchip/irq-gic-v3-its.c

+12 −2
Original line number Diff line number Diff line
@@ -4255,9 +4255,19 @@ static int its_vpe_set_affinity(struct irq_data *d, 
	 * Check if we're racing against a VPE being destroyed, for

	 * which we don't want to allow a VMOVP.

	 */

	if (!atomic_read(&vpe->vmapp_count))

	if (!atomic_read(&vpe->vmapp_count)) {

		if (gic_requires_eager_mapping())

			return -EINVAL;



		/*

		 * If we lazily map the VPEs, this isn't an error and

		 * we can exit cleanly.

		 */

		cpu = cpumask_first(mask_val);

		irq_data_update_effective_affinity(d, cpumask_of(cpu));

		return IRQ_SET_MASK_OK_DONE;

	}



	/*

	 * Changing affinity is mega expensive, so let's be as lazy as

	 * we can and only do it if we really have to. Also, if mapped