-stable review patch. If anyone has any objections, please let us know. --------------------- From: Ingo Molnar upstream commit: b1979a5fda7869a790f4fd83fb06c78498d26ba1 CR4 manipulation is not protected against interrupts and preemption, but KVM uses smp_function_call to manipulate the X86_CR4_VMXE bit either from the CPU hotplug code or from the kvm_init call. We need to protect the CR4 manipulation from both interrupts and preemption. Original bug report: http://lkml.org/lkml/2008/5/7/48 Bugzilla entry: http://bugzilla.kernel.org/show_bug.cgi?id=10642 This is not a regression from 2.6.25, it's a long standing and hard to trigger bug. Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Signed-off-by: Chris Wright --- include/asm-x86/tlbflush.h | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/include/asm-x86/tlbflush.h +++ b/include/asm-x86/tlbflush.h @@ -22,12 +22,23 @@ static inline void __native_flush_tlb(vo static inline void __native_flush_tlb_global(void) { - unsigned long cr4 = read_cr4(); + unsigned long flags; + unsigned long cr4; + /* + * Read-modify-write to CR4 - protect it from preemption and + * from interrupts. (Use the raw variant because this code can + * be called from deep inside debugging code.) + */ + raw_local_irq_save(flags); + + cr4 = read_cr4(); /* clear PGE */ write_cr4(cr4 & ~X86_CR4_PGE); /* write old PGE again and flush TLBs */ write_cr4(cr4); + + raw_local_irq_restore(flags); } static inline void __native_flush_tlb_single(unsigned long addr) -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/