mirror of
https://github.com/torvalds/linux.git
synced 2026-09-20 18:24:36 +02:00
21f12496fd
Mitigate a potential failure when inserting a new LPI into the VGIC LPI
xarray.
When vgic_add_lpi() is preparing to register a new LPI, it pre-allocates
an xarray entry using xa_reserve_irq(), so that it can later perform the
insertion under the xarray lock without allocating.
However, since xa_reserve_irq() is called before acquiring such lock,
there is a potential race where xa_reserve_irq() observes a populated
entry, thus not performing the allocation, and another CPU removes that
entry before the xarray lock is grabbed to perform the insertion.
CPU0 (Adding new LPI) CPU1 (Releasing LPI)
===================== ===================
vgic_add_lpi()
/* Entry populated, does not allocate */
xa_reserve_irq(.., intid, ..)
vgic_release_deleted_lpis()
xa_lock_irqsave()
vgic_release_lpi_locked()
xarray node freed --> __xa_erase(.., intid)
xa_unlock_irqrestore()
xa_lock_irqsave()
xa_load(.., intid) == NULL
vgic_try_get_irq_ref(NULL) == false
__xa_store(.., intid, irq, 0) <-- xarray node was freed, gfp=0
cannot allocate, returns -ENOMEM
This can happen e.g. if the guest issues a DISCARD while the LPI is
still referenced from a vCPU's active-pending list (ap_list), and the
same INTID is re-mapped via MAPTI.
Mitigate this by passing GFP_NOWAIT to __xa_store(), so that the
allocation can happen under the lock in the rare case that this
condition is hit. Add __GFP_ACCOUNT as well to match xa_reserve_irq()'s
flags.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes:
|
||
|---|---|---|
| .. | ||
| trace.h | ||
| vgic-debug.c | ||
| vgic-init.c | ||
| vgic-irqfd.c | ||
| vgic-its.c | ||
| vgic-kvm-device.c | ||
| vgic-mmio-v2.c | ||
| vgic-mmio-v3.c | ||
| vgic-mmio.c | ||
| vgic-mmio.h | ||
| vgic-v2.c | ||
| vgic-v3-nested.c | ||
| vgic-v3.c | ||
| vgic-v4.c | ||
| vgic-v5.c | ||
| vgic.c | ||
| vgic.h | ||