mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 23:24:50 +00:00
073d0552ea
Today it can happen that an event channel is being removed from the system while the event handling loop is active. This can lead to a race resulting in crashes or WARN() splats when trying to access the irq_info structure related to the event channel. Fix this problem by using a rwlock taken as reader in the event handling loop and as writer when deallocating the irq_info structure. As the observed problem was a NULL dereference in evtchn_from_irq() make this function more robust against races by testing the irq_info pointer to be not NULL before dereferencing it. And finally make all accesses to evtchn_to_irq[row][col] atomic ones in order to avoid seeing partial updates of an array element in irq handling. Note that irq handling can be entered only for event channels which have been valid before, so any not populated row isn't a problem in this regard, as rows are only ever added and never removed. This is XSA-331. Cc: stable@vger.kernel.org Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Reported-by: Jinoh Kang <luke1337@theori.io> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Wei Liu <wl@xen.org> |
||
|---|---|---|
| .. | ||
| events | ||
| xen-pciback | ||
| xenbus | ||
| xenfs | ||
| acpi.c | ||
| arm-device.c | ||
| balloon.c | ||
| biomerge.c | ||
| cpu_hotplug.c | ||
| dbgp.c | ||
| efi.c | ||
| evtchn.c | ||
| features.c | ||
| gntalloc.c | ||
| gntdev-common.h | ||
| gntdev-dmabuf.c | ||
| gntdev-dmabuf.h | ||
| gntdev.c | ||
| grant-table.c | ||
| Kconfig | ||
| Makefile | ||
| manage.c | ||
| mcelog.c | ||
| mem-reservation.c | ||
| pci.c | ||
| pcpu.c | ||
| platform-pci.c | ||
| privcmd-buf.c | ||
| privcmd.c | ||
| privcmd.h | ||
| pvcalls-back.c | ||
| pvcalls-front.c | ||
| pvcalls-front.h | ||
| swiotlb-xen.c | ||
| sys-hypervisor.c | ||
| time.c | ||
| unpopulated-alloc.c | ||
| xen-acpi-cpuhotplug.c | ||
| xen-acpi-memhotplug.c | ||
| xen-acpi-pad.c | ||
| xen-acpi-processor.c | ||
| xen-balloon.c | ||
| xen-front-pgdir-shbuf.c | ||
| xen-scsiback.c | ||
| xen-stub.c | ||
| xlate_mmu.c | ||