irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID
authorMarc Zyngier <marc.zyngier@arm.com>
Tue, 29 Jan 2019 10:02:33 +0000 (10:02 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 12 Feb 2019 18:46:12 +0000 (19:46 +0100)
commit2f2456fe6ae34cc2baa40cba73a1755b05c6adf9
treea1b3995abfe28ae30f55e6583c20ee196f759464
parent3d8343b78e31c14a16a3c8ba1a6c04ae884d0adb
irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID

commit 9791ec7df0e7b4d80706ccea8f24b6542f6059e9 upstream.

On systems or VMs where multiple devices share a single DevID
(because they sit behind a PCI bridge, or because the HW is
broken in funky ways), we reuse the save its_device structure
in order to reflect this.

It turns out that there is a distinct lack of locking when looking
up the its_device, and two device being probed concurrently can result
in double allocations. That's obviously not nice.

A solution for this is to have a per-ITS mutex that serializes device
allocation.

A similar issue exists on the freeing side, which can run concurrently
with the allocation. On top of now taking the appropriate lock, we
also make sure that a shared device is never freed, as we have no way
to currently track the life cycle of such object.

Reported-by: Zheng Xiang <zhengxiang9@huawei.com>
Tested-by: Zheng Xiang <zhengxiang9@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/irqchip/irq-gic-v3-its.c