Unverified Commit b152f5a5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6102 Fix CVE-2024-27437 

Merge Pull Request from: @ci-robot 
 
PR sync from: Jinjie Ruan <ruanjinjie@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FVRCMLXVWZNOEU5BAH47Z53KHBUTJ6DO/ 
CVE-2024-27437

Alex Williamson (1):
  vfio/pci: Disable auto-enable of exclusive INTx IRQ

Barry Song (1):
  genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9E6TU 
 
Link:https://gitee.com/openeuler/kernel/pulls/6102

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 5e6caa2c bf222257

drivers/vfio/pci/vfio_pci_intrs.c

+10 −7
Original line number Diff line number Diff line
@@ -220,8 +220,15 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd) 


	vdev->ctx[0].trigger = trigger;



	/*

	 * Devices without DisINTx support require an exclusive interrupt,

	 * IRQ masking is performed at the IRQ chip.  The masked status is

	 * protected by vdev->irqlock. Setup the IRQ without auto-enable and

	 * unmask as necessary below under lock.  DisINTx is unmodified by

	 * the IRQ configuration and may therefore use auto-enable.

	 */

	if (!vdev->pci_2_3)

		irqflags = 0;

		irqflags = IRQF_NO_AUTOEN;



	ret = request_irq(pdev->irq, vfio_intx_handler,

			  irqflags, vdev->ctx[0].name, vdev);
@@ -232,13 +239,9 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd) 
		return ret;

	}



	/*

	 * INTx disable will stick across the new irq setup,

	 * disable_irq won't.

	 */

	spin_lock_irqsave(&vdev->irqlock, flags);

	if (!vdev->pci_2_3 && vdev->ctx[0].masked)

		disable_irq_nosync(pdev->irq);

	if (!vdev->pci_2_3 && !vdev->ctx[0].masked)

		enable_irq(pdev->irq);

	spin_unlock_irqrestore(&vdev->irqlock, flags);



	return 0;

include/linux/interrupt.h

+4 −0
Original line number Diff line number Diff line
@@ -61,6 +61,9 @@ 
 *                interrupt handler after suspending interrupts. For system

 *                wakeup devices users need to implement wakeup detection in

 *                their interrupt handlers.

 * IRQF_NO_AUTOEN - Don't enable IRQ or NMI automatically when users request it.

 *                Users will enable it explicitly by enable_irq() or enable_nmi()

 *                later.

 */

#define IRQF_SHARED		0x00000080

#define IRQF_PROBE_SHARED	0x00000100
@@ -74,6 +77,7 @@ 
#define IRQF_NO_THREAD		0x00010000

#define IRQF_EARLY_RESUME	0x00020000

#define IRQF_COND_SUSPEND	0x00040000

#define IRQF_NO_AUTOEN		0x00080000



#define IRQF_TIMER		(__IRQF_TIMER | IRQF_NO_SUSPEND | IRQF_NO_THREAD)

kernel/irq/manage.c

+9 −2
Original line number Diff line number Diff line
@@ -1628,7 +1628,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) 
			irqd_set(&desc->irq_data, IRQD_NO_BALANCING);

		}



		if (irq_settings_can_autoenable(desc)) {

		if (!(new->flags & IRQF_NO_AUTOEN) &&

		    irq_settings_can_autoenable(desc)) {

			irq_startup(desc, IRQ_RESEND, IRQ_START_COND);

		} else {

			/*
@@ -2059,10 +2060,15 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler, 
	 * which interrupt is which (messes up the interrupt freeing

	 * logic etc).

	 *

	 * Also shared interrupts do not go well with disabling auto enable.

	 * The sharing interrupt might request it while it's still disabled

	 * and then wait for interrupts forever.

	 *

	 * Also IRQF_COND_SUSPEND only makes sense for shared interrupts and

	 * it cannot be set along with IRQF_NO_SUSPEND.

	 */

	if (((irqflags & IRQF_SHARED) && !dev_id) ||

	    ((irqflags & IRQF_SHARED) && (irqflags & IRQF_NO_AUTOEN)) ||

	    (!(irqflags & IRQF_SHARED) && (irqflags & IRQF_COND_SUSPEND)) ||

	    ((irqflags & IRQF_NO_SUSPEND) && (irqflags & IRQF_COND_SUSPEND)))

		return -EINVAL;
@@ -2218,7 +2224,8 @@ int request_nmi(unsigned int irq, irq_handler_t handler, 


	desc = irq_to_desc(irq);



	if (!desc || irq_settings_can_autoenable(desc) ||

	if (!desc || (irq_settings_can_autoenable(desc) &&

	    !(irqflags & IRQF_NO_AUTOEN)) ||

	    !irq_settings_can_request(desc) ||

	    WARN_ON(irq_settings_is_per_cpu_devid(desc)) ||

	    !irq_supports_nmi(desc))