Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 19 Dec 2022 15:35:33 +0100
From:   Johan Hovold <johan@kernel.org>
To:     Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Cc:     Marc Zyngier <maz@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Matthias Brugger <matthias.bgg@gmail.com>,
        yj.chiang@mediatek.com, phil.chang@mediatek.com,
        linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
        linux-mediatek@lists.infradead.org
Subject: Re: [PATCH] irqdomain: Fix irqdomain->revmap race
Message-ID: <Y6B2tTQCLXz/Oytt@hovoldconsulting.com>
References: <20221219130620.21092-1-mark-pk.tsai@mediatek.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20221219130620.21092-1-mark-pk.tsai@mediatek.com>
Precedence: bulk

On Mon, Dec 19, 2022 at 09:06:15PM +0800, Mark-PK Tsai wrote:
> The irqdomain->revmap(_tree) of a shared irq can be race updated
> as following, which result in an unexpected irq mapping:
> 
> ---------------------------------------------------------------
> (2 threads parse the same hwirq fwspec in the same time.)
> 
> Thread A 			Thread B
> irq_create_fwspec_mapping
> irq_find_mapping						Thread A: virq = 0, alloc a new irq_desc
> 				irq_create_fwspec_mapping
> 				irq_find_mapping		Thread B: virq = 0, alloc a new irq_desc
> irq_domain_alloc_irqs
> irq_domain_insert_irq						domain->revmap[hwirq] = irq_data(virq x)
> 				irq_domain_alloc_irqs
> 				irq_domain_insert_irq		domain->revmap[hwirq] = irq_data(virq x + 1)
> 
> virq = x			virq = x + 1
> ---------------------------------------------------------------
> 
> The virq x can't work because the revmap[hwirq] was
> overridden by thread B.
> 
> It seems both hierarchy and non-hierarchy irq domain have the same
> problem because the code from irq_find_mapping to revmap update are
> not protected by a same lock.
> 
> Do you have any suggestion about how to fix it properly?

This is being fixed here:

	https://lore.kernel.org/lkml/20221209140150.1453-1-johan+linaro@kernel.org/

Johan