Commit f0133719 authored by Juergen Gross's avatar Juergen Gross

xen/events: fix race in evtchn_fifo_unmask()

Unmasking a fifo event channel can result in unmasking it twice, once
directly in the kernel and once via a hypercall in case the event was
pending.

Fix that by doing the local unmask only if the event is not pending.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
parent 4d3fe31b
...@@ -227,19 +227,25 @@ static bool evtchn_fifo_is_masked(evtchn_port_t port) ...@@ -227,19 +227,25 @@ static bool evtchn_fifo_is_masked(evtchn_port_t port)
return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word)); return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
} }
/* /*
* Clear MASKED, spinning if BUSY is set. * Clear MASKED if not PENDING, spinning if BUSY is set.
* Return true if mask was cleared.
*/ */
static void clear_masked(volatile event_word_t *word) static bool clear_masked_cond(volatile event_word_t *word)
{ {
event_word_t new, old, w; event_word_t new, old, w;
w = *word; w = *word;
do { do {
if (w & (1 << EVTCHN_FIFO_PENDING))
return false;
old = w & ~(1 << EVTCHN_FIFO_BUSY); old = w & ~(1 << EVTCHN_FIFO_BUSY);
new = old & ~(1 << EVTCHN_FIFO_MASKED); new = old & ~(1 << EVTCHN_FIFO_MASKED);
w = sync_cmpxchg(word, old, new); w = sync_cmpxchg(word, old, new);
} while (w != old); } while (w != old);
return true;
} }
static void evtchn_fifo_unmask(evtchn_port_t port) static void evtchn_fifo_unmask(evtchn_port_t port)
...@@ -248,8 +254,7 @@ static void evtchn_fifo_unmask(evtchn_port_t port) ...@@ -248,8 +254,7 @@ static void evtchn_fifo_unmask(evtchn_port_t port)
BUG_ON(!irqs_disabled()); BUG_ON(!irqs_disabled());
clear_masked(word); if (!clear_masked_cond(word)) {
if (evtchn_fifo_is_pending(port)) {
struct evtchn_unmask unmask = { .port = port }; struct evtchn_unmask unmask = { .port = port };
(void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask); (void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment