xen/blkfront: harden blkfront against event channel storms

The Xen blkfront driver is still vulnerable for an attack via excessive
number of events sent by the backend. Fix that by using lateeoi event
channels.

This is part of XSA-391

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 8e3983e456f3cdb4c93883fe06a6f474e34d7b3b..286cf1afad7815d7e0b58815b58e7aa519d9d160 100644 (file)
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1512,9 +1512,12 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
        unsigned long flags;
        struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)dev_id;
        struct blkfront_info *info = rinfo->dev_info;
+       unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
 
-       if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
+       if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) {
+               xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
                return IRQ_HANDLED;
+       }
 
        spin_lock_irqsave(&rinfo->ring_lock, flags);
  again:
@@ -1530,6 +1533,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                unsigned long id;
                unsigned int op;
 
+               eoiflag = 0;
+
                RING_COPY_RESPONSE(&rinfo->ring, i, &bret);
                id = bret.id;
 
@@ -1646,6 +1651,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
 
        spin_unlock_irqrestore(&rinfo->ring_lock, flags);
 
+       xen_irq_lateeoi(irq, eoiflag);
+
        return IRQ_HANDLED;
 
  err:
@@ -1653,6 +1660,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
 
        spin_unlock_irqrestore(&rinfo->ring_lock, flags);
 
+       /* No EOI in order to avoid further interrupts. */
+
        pr_alert("%s disabled for further use\n", info->gd->disk_name);
        return IRQ_HANDLED;
 }
@@ -1692,8 +1701,8 @@ static int setup_blkring(struct xenbus_device *dev,
        if (err)
                goto fail;
 
-       err = bind_evtchn_to_irqhandler(rinfo->evtchn, blkif_interrupt, 0,
-                                       "blkif", rinfo);
+       err = bind_evtchn_to_irqhandler_lateeoi(rinfo->evtchn, blkif_interrupt,
+                                               0, "blkif", rinfo);
        if (err <= 0) {
                xenbus_dev_fatal(dev, err,
                                 "bind_evtchn_to_irqhandler failed");