Commit bf222257 authored by Alex Williamson's avatar Alex Williamson Committed by Jinjie Ruan
Browse files

vfio/pci: Disable auto-enable of exclusive INTx IRQ 

stable inclusion
from stable-v5.15.154
commit b7a2f0955ffceffadfe098b40b50307431f45438
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E6TU
CVE: CVE-2024-27437

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b7a2f0955ffceffadfe098b40b50307431f45438



--------------------------------

[ Upstream commit fe9a7082684eb059b925c535682e68c34d487d43 ]

Currently for devices requiring masking at the irqchip for INTx, ie.
devices without DisINTx support, the IRQ is enabled in request_irq()
and subsequently disabled as necessary to align with the masked status
flag.  This presents a window where the interrupt could fire between
these events, resulting in the IRQ incrementing the disable depth twice.
This would be unrecoverable for a user since the masked flag prevents
nested enables through vfio.

Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx
is never auto-enabled, then unmask as required.

Cc:  <stable@vger.kernel.org>
Fixes: 89e1f7d4 ("vfio: Add PCI device driver")
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Reviewed-by: default avatarEric Auger <eric.auger@redhat.com>
Link: https://lore.kernel.org/r/20240308230557.805580-2-alex.williamson@redhat.com


Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJinjie Ruan <ruanjinjie@huawei.com>
parent 8e07a682

drivers/vfio/pci/vfio_pci_intrs.c

+10 −7
Original line number Diff line number Diff line
@@ -202,8 +202,15 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd) 


	vdev->ctx[0].trigger = trigger;



	/*

	 * Devices without DisINTx support require an exclusive interrupt,

	 * IRQ masking is performed at the IRQ chip.  The masked status is

	 * protected by vdev->irqlock. Setup the IRQ without auto-enable and

	 * unmask as necessary below under lock.  DisINTx is unmodified by

	 * the IRQ configuration and may therefore use auto-enable.

	 */

	if (!vdev->pci_2_3)

		irqflags = 0;

		irqflags = IRQF_NO_AUTOEN;



	ret = request_irq(pdev->irq, vfio_intx_handler,

			  irqflags, vdev->ctx[0].name, vdev);
@@ -214,13 +221,9 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd) 
		return ret;

	}



	/*

	 * INTx disable will stick across the new irq setup,

	 * disable_irq won't.

	 */

	spin_lock_irqsave(&vdev->irqlock, flags);

	if (!vdev->pci_2_3 && vdev->ctx[0].masked)

		disable_irq_nosync(pdev->irq);

	if (!vdev->pci_2_3 && !vdev->ctx[0].masked)

		enable_irq(pdev->irq);

	spin_unlock_irqrestore(&vdev->irqlock, flags);



	return 0;