From: Greg Kroah-Hartman Date: Mon, 6 Mar 2023 18:53:52 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v6.2.3~62 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=126671bc8ce0d74c118c2d5c0074008c4abdc86b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: irqdomain-drop-bogus-fwspec-mapping-error-handling.patch irqdomain-fix-association-race.patch irqdomain-fix-disassociation-race.patch --- diff --git a/queue-4.19/irqdomain-drop-bogus-fwspec-mapping-error-handling.patch b/queue-4.19/irqdomain-drop-bogus-fwspec-mapping-error-handling.patch new file mode 100644 index 00000000000..2683dabc485 --- /dev/null +++ b/queue-4.19/irqdomain-drop-bogus-fwspec-mapping-error-handling.patch @@ -0,0 +1,46 @@ +From e3b7ab025e931accdc2c12acf9b75c6197f1c062 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:45 +0100 +Subject: irqdomain: Drop bogus fwspec-mapping error handling + +From: Johan Hovold + +commit e3b7ab025e931accdc2c12acf9b75c6197f1c062 upstream. + +In case a newly allocated IRQ ever ends up not having any associated +struct irq_data it would not even be possible to dispose the mapping. + +Replace the bogus disposal with a WARN_ON(). + +This will also be used to fix a shared-interrupt mapping race, hence the +CC-stable tag. + +Fixes: 1e2a7d78499e ("irqdomain: Don't set type when mapping an IRQ") +Cc: stable@vger.kernel.org # 4.8 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-4-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/irq/irqdomain.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -832,13 +832,8 @@ unsigned int irq_create_fwspec_mapping(s + } + + irq_data = irq_get_irq_data(virq); +- if (!irq_data) { +- if (irq_domain_is_hierarchy(domain)) +- irq_domain_free_irqs(virq, 1); +- else +- irq_dispose_mapping(virq); ++ if (WARN_ON(!irq_data)) + return 0; +- } + + /* Store trigger type */ + irqd_set_trigger_type(irq_data, type); diff --git a/queue-4.19/irqdomain-fix-association-race.patch b/queue-4.19/irqdomain-fix-association-race.patch new file mode 100644 index 00000000000..caaebd26b6d --- /dev/null +++ b/queue-4.19/irqdomain-fix-association-race.patch @@ -0,0 +1,83 @@ +From b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:43 +0100 +Subject: irqdomain: Fix association race + +From: Johan Hovold + +commit b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 upstream. + +The sanity check for an already mapped virq is done outside of the +irq_domain_mutex-protected section which means that an (unlikely) racing +association may not be detected. + +Fix this by factoring out the association implementation, which will +also be used in a follow-on change to fix a shared-interrupt mapping +race. + +Fixes: ddaf144c61da ("irqdomain: Refactor irq_domain_associate_many()") +Cc: stable@vger.kernel.org # 3.11 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-2-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/irq/irqdomain.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -515,8 +515,8 @@ void irq_domain_disassociate(struct irq_ + irq_domain_clear_mapping(domain, hwirq); + } + +-int irq_domain_associate(struct irq_domain *domain, unsigned int virq, +- irq_hw_number_t hwirq) ++static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq, ++ irq_hw_number_t hwirq) + { + struct irq_data *irq_data = irq_get_irq_data(virq); + int ret; +@@ -529,7 +529,6 @@ int irq_domain_associate(struct irq_doma + if (WARN(irq_data->domain, "error: virq%i is already associated", virq)) + return -EINVAL; + +- mutex_lock(&irq_domain_mutex); + irq_data->hwirq = hwirq; + irq_data->domain = domain; + if (domain->ops->map) { +@@ -546,7 +545,6 @@ int irq_domain_associate(struct irq_doma + } + irq_data->domain = NULL; + irq_data->hwirq = 0; +- mutex_unlock(&irq_domain_mutex); + return ret; + } + +@@ -557,12 +555,23 @@ int irq_domain_associate(struct irq_doma + + domain->mapcount++; + irq_domain_set_mapping(domain, hwirq, irq_data); +- mutex_unlock(&irq_domain_mutex); + + irq_clear_status_flags(virq, IRQ_NOREQUEST); + + return 0; + } ++ ++int irq_domain_associate(struct irq_domain *domain, unsigned int virq, ++ irq_hw_number_t hwirq) ++{ ++ int ret; ++ ++ mutex_lock(&irq_domain_mutex); ++ ret = irq_domain_associate_locked(domain, virq, hwirq); ++ mutex_unlock(&irq_domain_mutex); ++ ++ return ret; ++} + EXPORT_SYMBOL_GPL(irq_domain_associate); + + void irq_domain_associate_many(struct irq_domain *domain, unsigned int irq_base, diff --git a/queue-4.19/irqdomain-fix-disassociation-race.patch b/queue-4.19/irqdomain-fix-disassociation-race.patch new file mode 100644 index 00000000000..98ea1135478 --- /dev/null +++ b/queue-4.19/irqdomain-fix-disassociation-race.patch @@ -0,0 +1,51 @@ +From 3f883c38f5628f46b30bccf090faec054088e262 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:44 +0100 +Subject: irqdomain: Fix disassociation race + +From: Johan Hovold + +commit 3f883c38f5628f46b30bccf090faec054088e262 upstream. + +The global irq_domain_mutex is held when mapping interrupts from +non-hierarchical domains but currently not when disposing them. + +This specifically means that updates of the domain mapcount is racy +(currently only used for statistics in debugfs). + +Make sure to hold the global irq_domain_mutex also when disposing +mappings from non-hierarchical domains. + +Fixes: 9dc6be3d4193 ("genirq/irqdomain: Add map counter") +Cc: stable@vger.kernel.org # 4.13 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/irq/irqdomain.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -494,6 +494,9 @@ void irq_domain_disassociate(struct irq_ + return; + + hwirq = irq_data->hwirq; ++ ++ mutex_lock(&irq_domain_mutex); ++ + irq_set_status_flags(irq, IRQ_NOREQUEST); + + /* remove chip and handler */ +@@ -513,6 +516,8 @@ void irq_domain_disassociate(struct irq_ + + /* Clear reverse map for this hwirq */ + irq_domain_clear_mapping(domain, hwirq); ++ ++ mutex_unlock(&irq_domain_mutex); + } + + static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq, diff --git a/queue-4.19/series b/queue-4.19/series index 688a9151fe9..f423ede36a6 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -166,3 +166,6 @@ x86-microcode-amd-fix-mixed-steppings-support.patch x86-speculation-allow-enabling-stibp-with-legacy-ibrs.patch documentation-hw-vuln-document-the-interaction-between-ibrs-and-stibp.patch ima-align-ima_file_mmap-parameters-with-mmap_file-lsm-hook.patch +irqdomain-fix-association-race.patch +irqdomain-fix-disassociation-race.patch +irqdomain-drop-bogus-fwspec-mapping-error-handling.patch