linux/arch/x86
Thomas Gleixner 80ae7b1a91 x86/apic/vector: Prevent hlist corruption and leaks
Several people observed the WARN_ON() in irq_matrix_free() which triggers
when the caller tries to free an vector which is not in the allocation
range. Song provided the trace information which allowed to decode the root
cause.

The rework of the vector allocation mechanism failed to preserve a sanity
check, which prevents setting a new target vector/CPU when the previous
affinity change has not fully completed.

As a result a half finished affinity change can be overwritten, which can
cause the leak of a irq descriptor pointer on the previous target CPU and
double enqueue of the hlist head into the cleanup lists of two or more
CPUs. After one CPU cleaned up its vector the next CPU will invoke the
cleanup handler with vector 0, which triggers the out of range warning in
the matrix allocator.

Prevent this by checking the apic_data of the interrupt whether the
move_in_progress flag is false and the hlist node is not hashed. Return
-EBUSY if not.

This prevents the damage and restores the behaviour before the vector
allocation rework, but due to other changes in that area it also widens the
chance that user space can observe -EBUSY. In theory this should be fine,
but actually not all user space tools handle -EBUSY correctly. Addressing
that is not part of this fix, but will be addressed in follow up patches.

Fixes: 69cde0004a ("x86/vector: Use matrix allocator for vector assignment")
Reported-by: Dmitry Safonov <0x7f454c46@gmail.com>
Reported-by: Tariq Toukan <tariqt@mellanox.com>
Reported-by: Song Liu <liu.song.a23@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Song Liu <songliubraving@fb.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Cc: Mike Travis <mike.travis@hpe.com>
Cc: Borislav Petkov <bp@alien8.de>
Link: https://lkml.kernel.org/r/20180604162224.303870257@linutronix.de
2018-06-06 15:18:19 +02:00
..
boot x86/mm: Decouple dynamic __PHYSICAL_MASK from AMD SME 2018-06-06 13:38:01 +02:00
configs
crypto crypto: x86/des3_ede - des3_ede_skciphers[] can be static 2018-03-09 22:45:53 +08:00
entry x86/vdso: Remove unused file 2018-05-06 12:22:31 +02:00
events perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr 2018-05-05 08:37:31 +02:00
hyperv x86/hyper-v: allocate and use Virtual Processor Assist Pages 2018-03-28 22:47:06 +02:00
ia32 syscalls/x86: auto-create compat_sys_*() prototypes 2018-04-02 20:16:18 +02:00
include x86/vector: Fix the args of vector_alloc tracepoint 2018-06-06 13:38:02 +02:00
kernel x86/apic/vector: Prevent hlist corruption and leaks 2018-06-06 15:18:19 +02:00
kvm Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-05-26 13:24:16 -07:00
lib Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-04-02 15:16:43 -07:00
math-emu
mm x86/mm: Decouple dynamic __PHYSICAL_MASK from AMD SME 2018-06-06 13:38:01 +02:00
net bpf, x64: fix memleak when not converging on calls 2018-05-02 12:35:47 -07:00
oprofile x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() 2018-02-21 09:54:17 +01:00
pci Merge branch 'x86-dma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-04-02 17:18:45 -07:00
platform x86/platform/uv: Remove extra parentheses 2018-06-06 13:38:01 +02:00
power x86/power/64: Fix page-table setup for temporary text mapping 2018-04-20 11:52:00 +02:00
purgatory kernel/kexec_file.c: move purgatories sha256 to common code 2018-04-13 17:10:28 -07:00
ras
realmode x86-64/realmode: Add instruction suffix 2018-02-20 09:33:41 +01:00
tools x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 2018-02-22 09:01:10 -08:00
um Merge git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml 2018-04-11 16:36:47 -07:00
video
xen Some of the ftrace internal events use a zero for a data size of 2018-05-16 16:45:23 -07:00
.gitignore x86/build: Add arch/x86/tools/insn_decoder_test to .gitignore 2018-02-13 14:10:29 +01:00
Kbuild
Kconfig x86/mm: Decouple dynamic __PHYSICAL_MASK from AMD SME 2018-06-06 13:38:01 +02:00
Kconfig.cpu Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-03-25 07:36:02 -10:00
Kconfig.debug Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-01-30 13:01:09 -08:00
Makefile Merge branch 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-04-02 14:37:03 -07:00
Makefile_32.cpu
Makefile.um