[Xen-devel] xen: Fix possible page fault in fifo events

[Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>]

sync_test_bit function require a long* read access to pointer.
This is a problem if the you are using last entry in the page causing
an access to next page. If this page is not readable you get a memory
access failure (page fault).
All other x64 bit functions access memory using 32 bit operations.
For processors different than x64 long aligned operations are used.

Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>
---
 drivers/xen/events/events_fifo.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index d302639..af4672d 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -168,6 +168,11 @@ static int evtchn_fifo_setup(struct irq_info *info)
        return ret;
 }
 
+static __always_inline int test_fifo_bit(int nr, event_word_t *word)
+{
+       return (ACCESS_ONCE(*word) & (((event_word_t) 1) << nr)) != 0;
+}
+
 static void evtchn_fifo_bind_to_cpu(struct irq_info *info, unsigned cpu)
 {
        /* no-op */
@@ -188,7 +193,7 @@ static void evtchn_fifo_set_pending(unsigned port)
 static bool evtchn_fifo_is_pending(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-       return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
+       return test_fifo_bit(EVTCHN_FIFO_PENDING, word);
 }
 
 static bool evtchn_fifo_test_and_set_mask(unsigned port)
@@ -206,7 +211,7 @@ static void evtchn_fifo_mask(unsigned port)
 static bool evtchn_fifo_is_masked(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-       return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
+       return test_fifo_bit(EVTCHN_FIFO_MASKED, word);
 }
 /*
  * Clear MASKED, spinning if BUSY is set.
-- 
1.9.1



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel