Commit aa6b9c91 authored by Marc Zyngier's avatar Marc Zyngier Committed by Zheng Qixing
Browse files

irqchip/gic-v4: Don't allow a VMOVP on a dying VPE 

mainline inclusion
from mainline-v6.12-rc4
commit 1442ee0011983f0c5c4b92380e6853afb513841a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWE
CVE: CVE-2024-50192

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1442ee0011983f0c5c4b92380e6853afb513841a



--------------------

Kunkun Jiang reported that there is a small window of opportunity for
userspace to force a change of affinity for a VPE while the VPE has already
been unmapped, but the corresponding doorbell interrupt still visible in
/proc/irq/.

Plug the race by checking the value of vmapp_count, which tracks whether
the VPE is mapped ot not, and returning an error in this case.

This involves making vmapp_count common to both GICv4.1 and its v4.0
ancestor.

Fixes: 64edfaa9 ("irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP")
Reported-by: default avatarKunkun Jiang <jiangkunkun@huawei.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/c182ece6-2ba0-ce4f-3404-dba7a3ab6c52@huawei.com
Link: https://lore.kernel.org/all/20241002204959.2051709-1-maz@kernel.org



Conflicts:
        drivers/irqchip/irq-gic-v3-its.c
[Context conflict.]
        include/linux/irqchip/arm-gic-v4.h
[Context conflict.]
Signed-off-by: default avatarZheng Qixing <zhengqixing@huawei.com>
parent 37bf81d4

drivers/irqchip/irq-gic-v3-its.c

+12 −6
Original line number Diff line number Diff line
@@ -1106,8 +1106,8 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, 
	its_encode_valid(cmd, desc->its_vmapp_cmd.valid);



	if (!desc->its_vmapp_cmd.valid) {

		if (is_v4_1(its)) {

		alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count);

		if (is_v4_1(its)) {

			its_encode_alloc(cmd, alloc);

			/*

			 * Unmapping a VPE is self-synchronizing on GICv4.1,
@@ -1128,13 +1128,13 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, 
	its_encode_vpt_addr(cmd, vpt_addr);

	its_encode_vpt_size(cmd, LPI_NRBITS - 1);



	alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count);



	if (!is_v4_1(its))

		goto out;



	vconf_addr = virt_to_phys(page_address(desc->its_vmapp_cmd.vpe->its_vm->vprop_page));



	alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count);



	its_encode_alloc(cmd, alloc);



	/*
@@ -4251,6 +4251,13 @@ static int its_vpe_set_affinity(struct irq_data *d, 
	unsigned long flags;

	int from, cpu;



	/*

	 * Check if we're racing against a VPE being destroyed, for

	 * which we don't want to allow a VMOVP.

	 */

	if (!atomic_read(&vpe->vmapp_count))

		return -EINVAL;



	/*

	 * Changing affinity is mega expensive, so let's be as lazy as

	 * we can and only do it if we really have to. Also, if mapped
@@ -4956,9 +4963,8 @@ static int its_vpe_init(struct its_vpe *vpe) 
	raw_spin_lock_init(&vpe->vpe_lock);

	vpe->vpe_id = vpe_id;

	vpe->vpt_page = vpt_page;

	if (gic_rdists->has_rvpeid)

	atomic_set(&vpe->vmapp_count, 0);

	else

	if (!gic_rdists->has_rvpeid)

		vpe->vpe_proxy_event = -1;



	return 0;

include/linux/irqchip/arm-gic-v4.h

+3 −1
Original line number Diff line number Diff line
@@ -72,10 +72,12 @@ struct its_vpe { 
#else

			}                       sgi_config[16];

#endif

			atomic_t vmapp_count;

		};

	};



	/* Track the VPE being mapped */

	atomic_t vmapp_count;



	/*

	 * Ensures mutual exclusion between affinity setting of the

	 * vPE and vLPI operations using vpe->col_idx.