In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
powerpc\/entry: Fix irq_soft_mask corruption on replayed interrupt exit<\/p>\n
When __replay_soft_interrupts() replays a pending interrupt (e.g.
\nPACA_IRQ_DEC -> timer_interrupt), it calls the handler directly with a
\nsynthetic pt_regs. The DEFINE_INTERRUPT_HANDLER_ASYNC wrapper around
\neach handler calls arch_interrupt_async_exit_prepare() on the way out,
\nwhich calls arch_interrupt_exit_prepare() -> local_irq_disable() ->
\narch_local_irq_disable(), which does:<\/p>\n
irq_soft_mask_set(IRQS_DISABLED) \/* 0x1 *\/<\/p>\n
This unconditionally overwrites irq_soft_mask with IRQS_DISABLED (0x1),
\nstripping the IRQS_PMI_DISABLED (0x2) bit. The result is that
\nirq_soft_mask is 0x1 instead of IRQS_ALL_DISABLED (0x3) when the
\nhandler returns to __replay_soft_interrupts().<\/p>\n
For a normally-taken interrupt this is harmless: the next interrupt
\nalways enters through arch_interrupt_enter_prepare() which
\nunconditionally sets irq_soft_mask to IRQS_ALL_DISABLED. But during
\nreplay, next_interrupt() is called directly between replayed handlers
\nwithout going back through arch_interrupt_enter_prepare(), so the
\nstripped bit is never restored. next_interrupt() then fires a WARNING:<\/p>\n
WARNING: arch\/powerpc\/kernel\/irq_64.c:75
\n WARN_ON(irq_soft_mask_return() != IRQS_ALL_DISABLED)<\/p>\n
The warning was observed early in boot on a POWER10 pseries guest
\nduring kmem_cache_init_late(), where a spinlock release triggers
\ninterrupt replay that processes a pending timer interrupt.<\/p>\n
Debugger state confirming the bug:
\n Before timer_interrupt(®s):
\n irq_soft_mask = 0x3 (IRQS_ALL_DISABLED) correct
\n irq_happened = 0x41 (HARD_DIS|REPLAYING) correct
\n After timer_interrupt(®s) returns:
\n irq_soft_mask = 0x1 (IRQS_DISABLED) WRONG – PMI bit stripped
\n irq_happened = 0x41 unchanged<\/p>\n
The fix is to replace local_irq_disable() with hard_irq_disable().<\/p>\n
hard_irq_disable() is the right primitive here for two reasons:<\/p>\n
1. On PPC64 (hw_irq.h:301) it calls irq_soft_mask_set_return(IRQS_ALL_DISABLED),
\n setting the soft mask to 0x3 (both IRQS_DISABLED and IRQS_PMI_DISABLED),
\n which preserves the PMI bit and fixes the WARNING. The additional
\n work it does (__hard_irq_disable(), PACA_IRQ_HARD_DIS |=) is
\n redundant but safe since both are already set at this point in the
\n exit path; the trace_hardirqs_off() inside is guarded by
\n if (!arch_irqs_disabled_flags(flags)) so it will not double-fire.<\/p>\n
2. On PPC32 (hw_irq.h:467) hard_irq_disable() maps to
\n arch_local_irq_disable() -> __hard_irq_disable(), which clears
\n MSR[EE] in hardware. This is exactly correct: PPC32 has no soft-mask
\n PACA mechanism, so the hardware disable is the right way to satisfy
\n irqentry_exit()’s requirement. This also fixes a build error on PPC32
\n where irq_soft_mask_set() is only defined under CONFIG_PPC64:<\/p>\n
arch\/powerpc\/include\/asm\/entry-common.h:273: error: implicit
\n declaration of function ‘irq_soft_mask_set’<\/p>\n
Using hard_irq_disable() requires no #ifdef and is consistent with
\n how the rest of the entry code (e.g. entry-common.h:463) handles the
\n same PPC32\/PPC64 split.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
powerpc\/entry: Fix irq_soft_mask corruption on replayed interrupt exit<\/p>\n
When __replay_soft_interrupts() replays a pending interrupt<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39066","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39066","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39066"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39066"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}