Received-SPF: pass (google.com: domain of linux-kernel+bounces-96568-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: "Tian, Kevin" <kevin.tian@intel.com>
To: Alex Williamson <alex.williamson@redhat.com>
CC: "kvm@vger.kernel.org" <kvm@vger.kernel.org>, "eric.auger@redhat.com"
	<eric.auger@redhat.com>, "clg@redhat.com" <clg@redhat.com>, "Chatre,
 Reinette" <reinette.chatre@intel.com>, "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>
Subject: RE: [PATCH 4/7] vfio/pci: Create persistent INTx handler
Thread-Topic: [PATCH 4/7] vfio/pci: Create persistent INTx handler
Thread-Index: AQHacAtpqLYEq0v3LUa1TvP7mKsB87Etb6lA
Date: Fri, 8 Mar 2024 07:14:31 +0000
Message-ID: <BN9PR11MB52762A02AC3802CB2D550B8B8C272@BN9PR11MB5276.namprd11.prod.outlook.com>
References: <20240306211445.1856768-1-alex.williamson@redhat.com>
 <20240306211445.1856768-5-alex.williamson@redhat.com>
In-Reply-To: <20240306211445.1856768-5-alex.williamson@redhat.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?8dr6kPE4TDOSaHgF9Zu/jA6x6KKgxFcj/roNQ5l7YOQcNc+jP2UR620zVLJF?=
 =?us-ascii?Q?UWbCCsBFtLYlyDBrqZZ1aAlHFUW3Y7LEeDfzpBTOh1aUiEsa7P2Ival5llOB?=
 =?us-ascii?Q?c+KQoq3zDY0Y6C+NJwL4MmAfRDPmE+Sm/IFcOSeSyEM05PFHcHj0CuIQ9lux?=
 =?us-ascii?Q?COHFrDlI022RzerG6/Q7x4sDH8+Zs4LQ1JtDC03fI5X+L9NMJGs1E/yLsOy0?=
 =?us-ascii?Q?RU3crpskc9bzyw62Cc86joRB/3JdgPmAYlf9Ix8IAY884qzTZ5kzdUJr3sU7?=
 =?us-ascii?Q?D0+JzuBf4S+T8W9jA55Og9Th8k+pgh4hXMIPShUkF+gduSH/QB6lYxuTUUsX?=
 =?us-ascii?Q?G5K0GtRdyN6ZVdZnV3U06ZeRlhlMMHSSkx9qqvVxSOs78YTjxZyj0PFEqxtd?=
 =?us-ascii?Q?a3ZqewRCMBzZ94WXAF/Ig2TpD1m0LsmkDPo7nIT6CefOG85qofW1zENfn7fW?=
 =?us-ascii?Q?dtfpcyv8lzW2j1nOZTuBdk1KloPHyTU4PhQ1bxUIPtnT66iHQUjjuzmZtCAw?=
 =?us-ascii?Q?cG2UnGnenyXGSAtwdOX0FQvE4dgYRAU3Hjc6zcIw7wLNbK7Orh/c4UC5BBsQ?=
 =?us-ascii?Q?FkB5eo7fiS7AVcxk0pChUCjcIaq9F4G7DFrRWpfaH1hycLa7AvdrhidbSbVb?=
 =?us-ascii?Q?0XUwdXHEwRvfc50OdDJhwoU8UhRCIqrrVxY4bLn3taIqnc1kzQj0ycup3gBC?=
 =?us-ascii?Q?Q3ImgWO4AzRARb5I0BVjtaU0hNfygeY0yCnwMRkW+s1T74axhCyJqihyLrIx?=
 =?us-ascii?Q?nu1aikwy0hvGyspAPeWx8CkJWsaUO+mqxCBE23fW82KtkS9g4h1F6N92plw8?=
 =?us-ascii?Q?WwmmAUFBmdErFu5LToonCCJ2kyQ6GFGz32kpRhzcSChI0tzCi+PDsQxp9I7J?=
 =?us-ascii?Q?yZ+mgHKkn1+pitL2dFwAkxAf+dgd3Qlcm+NoBfkzhxa3N5vbRir0DaVpe1/f?=
 =?us-ascii?Q?ZGdoHWWaFF/G5jBYym+mvXil0k0NN6vNFEwd1EYN+gc+eFKaWSWfhAMRuuqn?=
 =?us-ascii?Q?vn9X9jeurMBb8hTPNMLBOlkVAhQRkkw5cSZ2MquaMF3JKf/LtrMbNR126PTT?=
 =?us-ascii?Q?XAd/8Ir6xmpjWoyy+zQuPoLHOQ8JxISUn/Ochep6KfMTPPjiOaBe9yqrTuJT?=
 =?us-ascii?Q?aSUuBRRxn/d6cZAZx/jJfKB80qW/anzUcCm4kf0LRl9CKi1tX8VOg6j8D+DU?=
 =?us-ascii?Q?Iwiy34JB3/3RETSnrtj5U+TtNzYFs4lhKFtU88bX0jjRyxW/X7kuYOmYYrLV?=
 =?us-ascii?Q?tshhZGbEUN7C4UnM+TWIbkTvYyAc2IVe1kz4U3j5/vdj8zBgRm5v1hCF73fo?=
 =?us-ascii?Q?3zkkQ4+jcehF4LVYZ+v/Qz4nkHa/Q0u2FpLaHpYPSOlQWBXi2uokZRZhVlHY?=
 =?us-ascii?Q?vDc8i1Udfge5385XHtO5fQBmFs71E/dvcEfwPq8oPg5NLSxlB7dI98fBYkgb?=
 =?us-ascii?Q?lEOIuEoBWqnWERLUJMTs7oIQ/m9ZyTXmdf7/bekdq1/nTD5LnJpq8nHSHMcK?=
 =?us-ascii?Q?OjA19JARRs+eDvWlwmBFNaGTXU1qoJi7Ocob6xS9yedjIPropbHac95bXC4m?=
 =?us-ascii?Q?SfFHmBF34mhuFqxzBa8fmmXtyoCkEm+wtUqTUhyE?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN9PR11MB5276.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8a5e5621-6c99-48fe-e943-08dc3f3f6684
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Mar 2024 07:14:31.4611
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: mfJfrItGzSCPxQzphTmOeMo5ZizGqx3UoUxV0SppKUDGTaaBs9QC41AtiBZ7d5VEGqdl+KsS8AkxV22SwNBckg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN9PR11MB5274
X-OriginatorOrg: intel.com

> From: Alex Williamson <alex.williamson@redhat.com>
> Sent: Thursday, March 7, 2024 5:15 AM
>=20
> A vulnerability exists where the eventfd for INTx signaling can be
> deconfigured, which unregisters the IRQ handler but still allows
> eventfds to be signaled with a NULL context through the SET_IRQS ioctl
> or through unmask irqfd if the device interrupt is pending.
>=20
> Ideally this could be solved with some additional locking; the igate
> mutex serializes the ioctl and config space accesses, and the interrupt
> handler is unregistered relative to the trigger, but the irqfd path
> runs asynchronous to those.  The igate mutex cannot be acquired from the
> atomic context of the eventfd wake function.  Disabling the irqfd
> relative to the eventfd registration is potentially incompatible with
> existing userspace.
>=20
> As a result, the solution implemented here moves configuration of the
> INTx interrupt handler to track the lifetime of the INTx context object
> and irq_type configuration, rather than registration of a particular
> trigger eventfd.  Synchronization is added between the ioctl path and
> eventfd_signal() wrapper such that the eventfd trigger can be
> dynamically updated relative to in-flight interrupts or irqfd callbacks.
>=20
> Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
> Reported-by: Reinette Chatre <reinette.chatre@intel.com>
> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>