Re: [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs
On 06/14/2018 04:21 AM, Roger Pau Monné wrote: > On Wed, Jun 13, 2018 at 07:48:50PM +0100, Ben Hutchings wrote: >> On Wed, 2018-02-28 at 09:19 +, Roger Pau Monne wrote: >>> From: Roger Pau Monne >>> >>> [ Upstream commit 910f8befdf5bccf25287d9f1743e3e546bcb7ce0 ] >>> >>> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is >>> wrong. First of all there's an off-by-one in the cleanup loop, which >>> can lead to unbinding wrong IRQs. >>> >>> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers. >>> >>> Note that there's no need to differentiate between bound and unbound >>> IRQs when freeing them, __unbind_from_irq will deal with both of them >>> correctly. >> It appears to me that it is safe to call __unbind_from_irq() after >> xen_irq_info_common_setup() fails, but *not* if the latter hasn't been >> called at all. In that case the IRQ type will still be set to >> IRQT_UNBOUND and this will trigger the BUG_ON() in __unbind_from_irq(). >> >> [...] >>> --- a/drivers/xen/events/events_base.c >>> +++ b/drivers/xen/events/events_base.c >>> @@ -764,8 +764,8 @@ out: >>> mutex_unlock(_mapping_update_lock); >>> return irq; >>> error_irq: >>> - for (; i >= 0; i--) >>> - __unbind_from_irq(irq + i); >>> + while (nvec--) >>> + __unbind_from_irq(irq + nvec); >> If nvec > 1, and xen_irq_info_pirq_setup() fails for i != nvec - 1, >> then we reach here without having called xen_irq_info_common_setup() >> for all these IRQs. >> >> In that case, I think we will still want to call xen_free_irq() for all >> IRQs. So maybe the fix would be to remove the BUG_ON() in >> __unbind_from_irq()? > I think your analysis is right, and I agree that removing the BUG_ON > from __unbind_from_irq seems like the right solution. > > I can't see any issues from calling xen_free_irq with type == > IRQT_UNBOUND, but I've already attempted to fix this once and failed, > so I would like to get second opinions. Also I'm not sure of the > reason behind that BUG_ON. I don't see a reason for the BUG_ON either. -boris
Re: [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs
On 06/14/2018 04:21 AM, Roger Pau Monné wrote: > On Wed, Jun 13, 2018 at 07:48:50PM +0100, Ben Hutchings wrote: >> On Wed, 2018-02-28 at 09:19 +, Roger Pau Monne wrote: >>> From: Roger Pau Monne >>> >>> [ Upstream commit 910f8befdf5bccf25287d9f1743e3e546bcb7ce0 ] >>> >>> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is >>> wrong. First of all there's an off-by-one in the cleanup loop, which >>> can lead to unbinding wrong IRQs. >>> >>> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers. >>> >>> Note that there's no need to differentiate between bound and unbound >>> IRQs when freeing them, __unbind_from_irq will deal with both of them >>> correctly. >> It appears to me that it is safe to call __unbind_from_irq() after >> xen_irq_info_common_setup() fails, but *not* if the latter hasn't been >> called at all. In that case the IRQ type will still be set to >> IRQT_UNBOUND and this will trigger the BUG_ON() in __unbind_from_irq(). >> >> [...] >>> --- a/drivers/xen/events/events_base.c >>> +++ b/drivers/xen/events/events_base.c >>> @@ -764,8 +764,8 @@ out: >>> mutex_unlock(_mapping_update_lock); >>> return irq; >>> error_irq: >>> - for (; i >= 0; i--) >>> - __unbind_from_irq(irq + i); >>> + while (nvec--) >>> + __unbind_from_irq(irq + nvec); >> If nvec > 1, and xen_irq_info_pirq_setup() fails for i != nvec - 1, >> then we reach here without having called xen_irq_info_common_setup() >> for all these IRQs. >> >> In that case, I think we will still want to call xen_free_irq() for all >> IRQs. So maybe the fix would be to remove the BUG_ON() in >> __unbind_from_irq()? > I think your analysis is right, and I agree that removing the BUG_ON > from __unbind_from_irq seems like the right solution. > > I can't see any issues from calling xen_free_irq with type == > IRQT_UNBOUND, but I've already attempted to fix this once and failed, > so I would like to get second opinions. Also I'm not sure of the > reason behind that BUG_ON. I don't see a reason for the BUG_ON either. -boris
Re: [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs
On Wed, Jun 13, 2018 at 07:48:50PM +0100, Ben Hutchings wrote: > On Wed, 2018-02-28 at 09:19 +, Roger Pau Monne wrote: > > From: Roger Pau Monne > > > > [ Upstream commit 910f8befdf5bccf25287d9f1743e3e546bcb7ce0 ] > > > > Current cleanup in the error path of xen_bind_pirq_msi_to_irq is > > wrong. First of all there's an off-by-one in the cleanup loop, which > > can lead to unbinding wrong IRQs. > > > > Secondly IRQs not bound won't be freed, thus leaking IRQ numbers. > > > > Note that there's no need to differentiate between bound and unbound > > IRQs when freeing them, __unbind_from_irq will deal with both of them > > correctly. > > It appears to me that it is safe to call __unbind_from_irq() after > xen_irq_info_common_setup() fails, but *not* if the latter hasn't been > called at all. In that case the IRQ type will still be set to > IRQT_UNBOUND and this will trigger the BUG_ON() in __unbind_from_irq(). > > [...] > > --- a/drivers/xen/events/events_base.c > > +++ b/drivers/xen/events/events_base.c > > @@ -764,8 +764,8 @@ out: > > mutex_unlock(_mapping_update_lock); > > return irq; > > error_irq: > > - for (; i >= 0; i--) > > - __unbind_from_irq(irq + i); > > + while (nvec--) > > + __unbind_from_irq(irq + nvec); > > If nvec > 1, and xen_irq_info_pirq_setup() fails for i != nvec - 1, > then we reach here without having called xen_irq_info_common_setup() > for all these IRQs. > > In that case, I think we will still want to call xen_free_irq() for all > IRQs. So maybe the fix would be to remove the BUG_ON() in > __unbind_from_irq()? I think your analysis is right, and I agree that removing the BUG_ON from __unbind_from_irq seems like the right solution. I can't see any issues from calling xen_free_irq with type == IRQT_UNBOUND, but I've already attempted to fix this once and failed, so I would like to get second opinions. Also I'm not sure of the reason behind that BUG_ON. Roger.
Re: [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs
On Wed, Jun 13, 2018 at 07:48:50PM +0100, Ben Hutchings wrote: > On Wed, 2018-02-28 at 09:19 +, Roger Pau Monne wrote: > > From: Roger Pau Monne > > > > [ Upstream commit 910f8befdf5bccf25287d9f1743e3e546bcb7ce0 ] > > > > Current cleanup in the error path of xen_bind_pirq_msi_to_irq is > > wrong. First of all there's an off-by-one in the cleanup loop, which > > can lead to unbinding wrong IRQs. > > > > Secondly IRQs not bound won't be freed, thus leaking IRQ numbers. > > > > Note that there's no need to differentiate between bound and unbound > > IRQs when freeing them, __unbind_from_irq will deal with both of them > > correctly. > > It appears to me that it is safe to call __unbind_from_irq() after > xen_irq_info_common_setup() fails, but *not* if the latter hasn't been > called at all. In that case the IRQ type will still be set to > IRQT_UNBOUND and this will trigger the BUG_ON() in __unbind_from_irq(). > > [...] > > --- a/drivers/xen/events/events_base.c > > +++ b/drivers/xen/events/events_base.c > > @@ -764,8 +764,8 @@ out: > > mutex_unlock(_mapping_update_lock); > > return irq; > > error_irq: > > - for (; i >= 0; i--) > > - __unbind_from_irq(irq + i); > > + while (nvec--) > > + __unbind_from_irq(irq + nvec); > > If nvec > 1, and xen_irq_info_pirq_setup() fails for i != nvec - 1, > then we reach here without having called xen_irq_info_common_setup() > for all these IRQs. > > In that case, I think we will still want to call xen_free_irq() for all > IRQs. So maybe the fix would be to remove the BUG_ON() in > __unbind_from_irq()? I think your analysis is right, and I agree that removing the BUG_ON from __unbind_from_irq seems like the right solution. I can't see any issues from calling xen_free_irq with type == IRQT_UNBOUND, but I've already attempted to fix this once and failed, so I would like to get second opinions. Also I'm not sure of the reason behind that BUG_ON. Roger.
Re: [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs
On Wed, 2018-02-28 at 09:19 +, Roger Pau Monne wrote: > From: Roger Pau Monne > > [ Upstream commit 910f8befdf5bccf25287d9f1743e3e546bcb7ce0 ] > > Current cleanup in the error path of xen_bind_pirq_msi_to_irq is > wrong. First of all there's an off-by-one in the cleanup loop, which > can lead to unbinding wrong IRQs. > > Secondly IRQs not bound won't be freed, thus leaking IRQ numbers. > > Note that there's no need to differentiate between bound and unbound > IRQs when freeing them, __unbind_from_irq will deal with both of them > correctly. It appears to me that it is safe to call __unbind_from_irq() after xen_irq_info_common_setup() fails, but *not* if the latter hasn't been called at all. In that case the IRQ type will still be set to IRQT_UNBOUND and this will trigger the BUG_ON() in __unbind_from_irq(). [...] > --- a/drivers/xen/events/events_base.c > +++ b/drivers/xen/events/events_base.c > @@ -764,8 +764,8 @@ out: > mutex_unlock(_mapping_update_lock); > return irq; > error_irq: > - for (; i >= 0; i--) > - __unbind_from_irq(irq + i); > + while (nvec--) > + __unbind_from_irq(irq + nvec); If nvec > 1, and xen_irq_info_pirq_setup() fails for i != nvec - 1, then we reach here without having called xen_irq_info_common_setup() for all these IRQs. In that case, I think we will still want to call xen_free_irq() for all IRQs. So maybe the fix would be to remove the BUG_ON() in __unbind_from_irq()? Ben. > mutex_unlock(_mapping_update_lock); > return ret; > } -- Ben Hutchings, Software Developer Codethink Ltd https://www.codethink.co.uk/ Dale House, 35 Dale Street Manchester, M1 2HF, United Kingdom
Re: [PATCH 4.4 119/268] xen/pirq: fix error path cleanup when binding MSIs
On Wed, 2018-02-28 at 09:19 +, Roger Pau Monne wrote: > From: Roger Pau Monne > > [ Upstream commit 910f8befdf5bccf25287d9f1743e3e546bcb7ce0 ] > > Current cleanup in the error path of xen_bind_pirq_msi_to_irq is > wrong. First of all there's an off-by-one in the cleanup loop, which > can lead to unbinding wrong IRQs. > > Secondly IRQs not bound won't be freed, thus leaking IRQ numbers. > > Note that there's no need to differentiate between bound and unbound > IRQs when freeing them, __unbind_from_irq will deal with both of them > correctly. It appears to me that it is safe to call __unbind_from_irq() after xen_irq_info_common_setup() fails, but *not* if the latter hasn't been called at all. In that case the IRQ type will still be set to IRQT_UNBOUND and this will trigger the BUG_ON() in __unbind_from_irq(). [...] > --- a/drivers/xen/events/events_base.c > +++ b/drivers/xen/events/events_base.c > @@ -764,8 +764,8 @@ out: > mutex_unlock(_mapping_update_lock); > return irq; > error_irq: > - for (; i >= 0; i--) > - __unbind_from_irq(irq + i); > + while (nvec--) > + __unbind_from_irq(irq + nvec); If nvec > 1, and xen_irq_info_pirq_setup() fails for i != nvec - 1, then we reach here without having called xen_irq_info_common_setup() for all these IRQs. In that case, I think we will still want to call xen_free_irq() for all IRQs. So maybe the fix would be to remove the BUG_ON() in __unbind_from_irq()? Ben. > mutex_unlock(_mapping_update_lock); > return ret; > } -- Ben Hutchings, Software Developer Codethink Ltd https://www.codethink.co.uk/ Dale House, 35 Dale Street Manchester, M1 2HF, United Kingdom
