[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH for-4.22 1/2] xen/arm: validate IRQs before descriptor lookup
- To: "Orzel, Michal" <michal.orzel@xxxxxxx>
- From: Mykola Kvach <mykola_kvach@xxxxxxxx>
- Date: Fri, 10 Jul 2026 14:48:13 +0300
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Gc9m+btl+oEKpV/nf/s1JzhByZUao75FbmBmv4o57Wo=; b=YUyEVA8Snwr+7AaKyfn3v6oL1uUToH1gRWQXFyoEKuoBpp5pVHV3xRPX7iQ6uI4+020YvrirNQQRCDg7fAQz4/INGpMUclZ/+r1Udh0ex70oFvVhi5IEWQIBEO6PhkOmxkcJWOzYZL1l9wQc/tY+F9+jk1REL61SknCwNMMOaAXOn4bvO/sgJlN7l4H6hKtYKIZ52ZWfcuWTcYGp1DzW0DlLmVba4TOLJpSBPNYHT40TG+o/RiekrYwJ6ztmwPAZuFdYSiueutmd+iMb9urUdbfbw648LvxS4cqi+vlAWtcNFc4i3PKd6zxNmy7JdctNyBi8EOyOu44BjftFQl+jwA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XnrcGPUWrO8UwJAhM2HIRQhusMnvjeEiUQ3hwL5t7vtPgH+bvLt9Ifrx5NmjY+5EVeMphaucZc5RFSb1iZvo1XTsGOAYjBtCncU5XmdVq6o6OHpTAD07IqoxaHrF8bJLo6sk+nWOlBFZ4x/SU0SbFwcMGHUb1FN62bjqYVr/JLqvjdxvk555wuntkwVCGC3Ytg3M+Wb11tawVJd9+Ft08ChQi1YjFH4RlEl+dfhl7hUB5xwDz1aLKgSrZHKyaEJZqFbOXiWtYsBNm8KtKs6Yqssogs704lDIWqv/x+ar4OQfWxBJRqpMP/2ccQj4pN52dULXqRRsPbkFLxvE9L7yDA==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com;
- Cc: xen-devel@xxxxxxxxxxxxxxxxxxxx, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
- Delivery-date: Fri, 10 Jul 2026 11:48:31 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Mail-followup-to: "Orzel, Michal" <michal.orzel@xxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxx, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
On Fri, Jul 10, 2026 at 12:44:44PM +0200, Orzel, Michal wrote:
> On a tangent note:
> I can see that you pushed quite a few "for-4.22" patches. We are approaching
> the
> release, so afaict at this point we should only be taking crucial bug fixes.
> Moreover, when sending "for-X" patches, please include a description with your
> analyzed pros/cons of taking a patch in.
Ack. I understand. For this patch specifically, I consider it a crucial
fix for 4.22 for the following reasons:
Pros:
- It prevents an out-of-bounds irq_desc[] access which may corrupt Xen
memory or crash the hypervisor.
- The issue was introduced by eSPI support already present in 4.22.
- The change is small, and valid IRQ handling remains unchanged.
- I tested CONFIG_GICV3_ESPI=y and CONFIG_GICV3_ESPI=n builds and
reproduced the issue on FVP using a fake DT interrupt with reserved
INTID 3000.
Cons:
- The trigger requires either a malformed DT interrupt specifier, such
as reserved INTID 3000, or an eSPI unsupported by the Xen build.
- The demonstrated failure used deliberate fault injection rather than
a reported production failure.
- The patch adds validation to common Arm IRQ setup paths, although
valid IRQs continue through the same path as before.
Assessment:
The hypervisor memory-safety impact and the presence of the affected
eSPI code in 4.22 outweigh the limited regression risk.
I will include this kind of pros/cons analysis with future for-X
submissions.
Best regards,
Mykola
|
