From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 804B6C43603 for ; Sun, 2 May 2021 14:05:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 612D5613C5 for ; Sun, 2 May 2021 14:05:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232554AbhEBOGM (ORCPT ); Sun, 2 May 2021 10:06:12 -0400 Received: from mail.kernel.org ([198.145.29.99]:50156 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232543AbhEBOE4 (ORCPT ); Sun, 2 May 2021 10:04:56 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id D6631613AC; Sun, 2 May 2021 14:04:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1619964244; bh=s4bEDhrcdO7IwratN3VIoVQJwBOVOaLx+cy+meq0g8w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Fjc0LVkj86D6F5F4krcMxxkbW7VUKiB8HcT1zv/xep18ewwuKlI8Qr8/PsF8W37Vw kqMW2mikCwfAyt8eIpzq+6s5CAY4NXY/2czPdbuSSXZbPWD4gb6KATL84Hq/1yUuKf 3wZ24ywtkCoy1nUNvEvgDNCrY2skjA8P8XuWRxhOOEpEFB4L42AFw7EVk64t0T3NqO Qw69DgAacKqjO1jbtdCwXonPZ07Jg8e1jM/Iv5RKUCWy0u04RUnrwiwt46V+WfS7hg 9G7/fe+G23WeeUQT02ebMsHykJHLsuBlHk9wrKN3H8BYUyc06elFzftJdREM8x2i8+ rBTzw4FU8bIbA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Vitaly Kuznetsov , Thomas Gleixner , Sasha Levin Subject: [PATCH AUTOSEL 5.11 14/70] genirq/matrix: Prevent allocation counter corruption Date: Sun, 2 May 2021 10:02:48 -0400 Message-Id: <20210502140344.2719040-14-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210502140344.2719040-1-sashal@kernel.org> References: <20210502140344.2719040-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Vitaly Kuznetsov [ Upstream commit c93a5e20c3c2dabef8ea360a3d3f18c6f68233ab ] When irq_matrix_free() is called for an unallocated vector the managed_allocated and total_allocated counters get out of sync with the real state of the matrix. Later, when the last interrupt is freed, these counters will underflow resulting in UINTMAX because the counters are unsigned. While this is certainly a problem of the calling code, this can be catched in the allocator by checking the allocation bit for the to be freed vector which simplifies debugging. An example of the problem described above: https://lore.kernel.org/lkml/20210318192819.636943062@linutronix.de/ Add the missing sanity check and emit a warning when it triggers. Suggested-by: Thomas Gleixner Signed-off-by: Vitaly Kuznetsov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210319111823.1105248-1-vkuznets@redhat.com Signed-off-by: Sasha Levin --- kernel/irq/matrix.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c index 651a4ad6d711..8e586858bcf4 100644 --- a/kernel/irq/matrix.c +++ b/kernel/irq/matrix.c @@ -423,7 +423,9 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu, if (WARN_ON_ONCE(bit < m->alloc_start || bit >= m->alloc_end)) return; - clear_bit(bit, cm->alloc_map); + if (WARN_ON_ONCE(!test_and_clear_bit(bit, cm->alloc_map))) + return; + cm->allocated--; if(managed) cm->managed_allocated--; -- 2.30.2