linux/kernel/irq
Thomas Gleixner c291ee6221 genirq: Prevent proc race against freeing of irq descriptors
Since the rework of the sparse interrupt code to actually free the
unused interrupt descriptors there exists a race between the /proc
interfaces to the irq subsystem and the code which frees the interrupt
descriptor.

CPU0				CPU1
				show_interrupts()
				  desc = irq_to_desc(X);
free_desc(desc)
  remove_from_radix_tree();
  kfree(desc);
				  raw_spinlock_irq(&desc->lock);

/proc/interrupts is the only interface which can actively corrupt
kernel memory via the lock access. /proc/stat can only read from freed
memory. Extremly hard to trigger, but possible.

The interfaces in /proc/irq/N/ are not affected by this because the
removal of the proc file is serialized in procfs against concurrent
readers/writers. The removal happens before the descriptor is freed.

For architectures which have CONFIG_SPARSE_IRQ=n this is a non issue
as the descriptor is never freed. It's merely cleared out with the irq
descriptor lock held. So any concurrent proc access will either see
the old correct value or the cleared out ones.

Protect the lookup and access to the irq descriptor in
show_interrupts() with the sparse_irq_lock.

Provide kstat_irqs_usr() which is protecting the lookup and access
with sparse_irq_lock and switch /proc/stat to use it.

Document the existing kstat_irqs interfaces so it's clear that the
caller needs to take care about protection. The users of these
interfaces are either not affected due to SPARSE_IRQ=n or already
protected against removal.

Fixes: 1f5a5b87f7 "genirq: Implement a sane sparse_irq allocator"
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
2014-12-13 13:33:07 +01:00
..
autoprobe.c genirq: Handle pending irqs in irq_startup() 2012-02-15 11:56:59 +01:00
chip.c genirq: Work around __irq_set_handler vs stacked domains ordering issues 2014-11-23 13:01:47 +01:00
debug.h irq: hide debug macros so they don't collide with others. 2012-04-23 12:30:03 -04:00
devres.c genirq: fix reference in devm_request_threaded_irq comment 2014-08-28 15:22:00 +02:00
dummychip.c genirq: Export dummy_irq_chip 2012-08-21 16:14:23 +02:00
generic-chip.c genirq: Generic chip: Add big endian I/O accessors 2014-11-09 04:02:00 +00:00
handle.c genirq: Export symbol no_action() 2014-03-22 11:33:09 +01:00
internals.h genirq: Prevent proc race against freeing of irq descriptors 2014-12-13 13:33:07 +01:00
irqdesc.c genirq: Prevent proc race against freeing of irq descriptors 2014-12-13 13:33:07 +01:00
irqdomain.c irqdomain: Introduce helper function irq_domain_add_hierarchy() 2014-11-23 13:01:46 +01:00
Kconfig genirq: Add generic msi irq domain support 2014-11-23 13:01:47 +01:00
Makefile genirq: Add generic msi irq domain support 2014-11-23 13:01:47 +01:00
manage.c genirq: Add IRQ_SET_MASK_OK_DONE to support stacked irqchip 2014-11-23 13:01:46 +01:00
migration.c genirq: Introduce irq_do_set_affinity() to reduce duplicated code 2012-05-24 22:36:40 +02:00
msi.c genirq: Move irq_chip_write_msi_msg() helper to core 2014-12-07 21:49:45 +01:00
pm.c genirq: Simplify wakeup mechanism 2014-09-01 13:48:59 +02:00
proc.c genirq: Prevent proc race against freeing of irq descriptors 2014-12-13 13:33:07 +01:00
resend.c genirq: Provide means to retrigger parent 2012-11-01 12:11:31 +01:00
settings.h genirq: Prevent spurious detection for unconditionally polled interrupts 2013-11-13 16:03:02 +01:00
spurious.c genirq: Sanitize spurious interrupt detection of threaded irqs 2014-05-03 23:15:39 +02:00