From patchwork Tue Aug 25 15:22:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Gleixner X-Patchwork-Id: 11735919 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1E251913 for ; Tue, 25 Aug 2020 15:24:21 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id EDB7520786 for ; Tue, 25 Aug 2020 15:24:20 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="Qj+BGek6"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="AeXFkLvw" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EDB7520786 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linutronix.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1kAamv-0007zF-5D; Tue, 25 Aug 2020 15:23:05 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1kAamu-0007zA-I1 for xen-devel@lists.xenproject.org; Tue, 25 Aug 2020 15:23:04 +0000 X-Inumbo-ID: 0bd0e0eb-cba6-4203-9b7a-5bff54bf12d1 Received: from galois.linutronix.de (unknown [193.142.43.55]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 0bd0e0eb-cba6-4203-9b7a-5bff54bf12d1; Tue, 25 Aug 2020 15:23:02 +0000 (UTC) From: Thomas Gleixner DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1598368981; h=from:from:reply-to:subject:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references; bh=av1m+1kxx0uAiVcVtSqAkN5hIO2GB8aGHtHRf9Awh1M=; b=Qj+BGek6+iQDiAWTLg+MX28+Jg16I6rIFUVYnYfOTHI1Enp0BOt1uLOrpnq2Eud6rh70VN kn/PO1N6Q7jSRTGrJ+qaV5NGM0iKGWgHbFSdofXJhLWOWw2j4K9/7/h+TwjE8cHFis96Av a5+AgRQMI9oK7tRs6R8wfe4CXOr6PKTVfoMN5fn3sULJmn1bTyvSQDUcyScrvY6X7rqMpx wovpHVpit/tU7ipzBy4CFjMjL81ssb85Leiyzo4uAJrFnss1ShaNeAjfzL+u+sv3KhwSYp mvkNVmvxAPEAQjI75Fm/FTGIuxf8uj9XeiyQG35jCOn3xLE/ncVHsfLedsB+PQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1598368981; h=from:from:reply-to:subject:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references; bh=av1m+1kxx0uAiVcVtSqAkN5hIO2GB8aGHtHRf9Awh1M=; b=AeXFkLvwt7OZUR5h3/I0qgXxgQoaVPjk7tWwkRH5CvYd+3xN2oLWjtX8Uo6h7zcHlv0TmN p4iyNw6w7R/tEVDw== To: =?utf-8?b?SsO8cmdlbiBHcm/Dnw==?= Cc: Sergei Temerkhanov , xen-devel@lists.xenproject.org, Stefano Stabellini , Roman Shaposhnik Subject: [PATCH] xen/events: Use chip data for storing per IRQ XEN data pointer Subject: In-Reply-To: References: <20200821071547.18894-1-s.temerkhanov@gmail.com> <871rjzsqyy.fsf@nanos.tec.linutronix.de> <87k0xn5cgl.fsf@nanos.tec.linutronix.de> Date: Tue, 25 Aug 2020 17:22:58 +0200 Message-ID: <87lfi2yckt.fsf@nanos.tec.linutronix.de> MIME-Version: 1.0 X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information. handler data is meant for interrupt handlers and not for storing irq chip specific information as some devices require handler data to store internal per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers. This obviously creates a conflict of interests and crashes the machine because the XEN pointer is overwritten by the driver pointer. As the XEN data is not handler specific it should be stored in irqdesc::irq_data::chip_data instead. A simple sed s/irq_[sg]et_handler_data/irq_[sg]et_chip_data/ cures that. Reported-by: Roman Shaposhnik Signed-off-by: Thomas Gleixner Reviewed-by: Juergen Gross Tested-by: Roman Shaposhnik --- Note: This probably wants a 'Cc: stable@' and a 'Fixes:' tag, but I leave that as an exercise to the maintainers how far they want to move that back. --- drivers/xen/events/events_base.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -156,7 +156,7 @@ int get_evtchn_to_irq(evtchn_port_t evtc /* Get info for IRQ */ struct irq_info *info_for_irq(unsigned irq) { - return irq_get_handler_data(irq); + return irq_get_chip_data(irq); } /* Constructors for packed IRQ information. */ @@ -377,7 +377,7 @@ static void xen_irq_init(unsigned irq) info->type = IRQT_UNBOUND; info->refcnt = -1; - irq_set_handler_data(irq, info); + irq_set_chip_data(irq, info); list_add_tail(&info->list, &xen_irq_list_head); } @@ -426,14 +426,14 @@ static int __must_check xen_allocate_irq static void xen_free_irq(unsigned irq) { - struct irq_info *info = irq_get_handler_data(irq); + struct irq_info *info = irq_get_chip_data(irq); if (WARN_ON(!info)) return; list_del(&info->list); - irq_set_handler_data(irq, NULL); + irq_set_chip_data(irq, NULL); WARN_ON(info->refcnt > 0); @@ -603,7 +603,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); static void __unbind_from_irq(unsigned int irq) { evtchn_port_t evtchn = evtchn_from_irq(irq); - struct irq_info *info = irq_get_handler_data(irq); + struct irq_info *info = irq_get_chip_data(irq); if (info->refcnt > 0) { info->refcnt--; @@ -1108,7 +1108,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect void unbind_from_irqhandler(unsigned int irq, void *dev_id) { - struct irq_info *info = irq_get_handler_data(irq); + struct irq_info *info = irq_get_chip_data(irq); if (WARN_ON(!info)) return; @@ -1142,7 +1142,7 @@ int evtchn_make_refcounted(evtchn_port_t if (irq == -1) return -ENOENT; - info = irq_get_handler_data(irq); + info = irq_get_chip_data(irq); if (!info) return -ENOENT; @@ -1170,7 +1170,7 @@ int evtchn_get(evtchn_port_t evtchn) if (irq == -1) goto done; - info = irq_get_handler_data(irq); + info = irq_get_chip_data(irq); if (!info) goto done;