lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 27 Jun 2015 13:00:46 +0200 From: Borislav Petkov <bp@...en8.de> To: Jan Kiszka <jan.kiszka@....de> Cc: Thomas Gleixner <tglx@...utronix.de>, LKML <linux-kernel@...r.kernel.org>, Ingo Molnar <mingo@...nel.org>, Peter Zijlstra <peterz@...radead.org>, Paul McKenney <paulmck@...ux.vnet.ibm.com>, Frederic Weisbecker <fweisbec@...il.com>, Eric Dumazet <edumazet@...gle.com>, Viresh Kumar <viresh.kumar@...aro.org>, John Stultz <john.stultz@...aro.org>, Joonwoo Park <joonwoop@...eaurora.org>, Wenbo Wang <wenbo.wang@...blaze.com>, Steven Rostedt <rostedt@...dmis.org>, Badhri Jagan Sridharan <Badhri@...gle.com> Subject: Re: [PATCH] timer: Fix unsafe cpu variable access in migrate_timers On Sat, Jun 27, 2015 at 11:55:49AM +0200, Jan Kiszka wrote: > From: Jan Kiszka <jan.kiszka@...mens.com> > > migrate_timers is invoked with preemption enabled. Therefore we have to > get/put the cpu-local variable tvec_bases like before commit 0eeda71bc3. > > This fixes > > BUG: using smp_processor_id() in preemptible [00000000] code: bash/4917 > caller is debug_smp_processor_id+0x17/0x19 > CPU: 0 PID: 4917 Comm: bash Not tainted 4.1.0-dbg+ #97 > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014 > ffff880038674040 ffff880002e6fb98 ffffffff815356a0 0000000000000002 > 0000000000000000 ffff880002e6fbc8 ffffffff8130c16f ffff88003fd8d500 > 000000000000d500 0000000000000000 0000000000000003 ffff880002e6fbd8 > Call Trace: > [<ffffffff815356a0>] dump_stack+0x4f/0x7b > [<ffffffff8130c16f>] check_preemption_disabled+0xdd/0xef > [<ffffffff8130c198>] debug_smp_processor_id+0x17/0x19 > [<ffffffff810a9b37>] timer_cpu_notify+0x4f/0x112 > [<ffffffff8106718b>] notifier_call_chain+0x4c/0x71 > [<ffffffff810671be>] __raw_notifier_call_chain+0xe/0x10 > [<ffffffff810484b6>] __cpu_notify+0x20/0x37 > [<ffffffff810484e0>] cpu_notify+0x13/0x15 > [<ffffffff81048591>] cpu_notify_nofail+0xe/0x16 > [<ffffffff8152efb2>] _cpu_down+0x178/0x268 > [<ffffffff8108bc3a>] ? trace_hardirqs_on+0xd/0xf > [<ffffffff8152f0ca>] cpu_down+0x28/0x3c > [<ffffffff813cbdb9>] cpu_subsys_offline+0x14/0x16 > [<ffffffff813c779d>] device_offline+0x7d/0xb1 > [<ffffffff813c78a2>] online_store+0x48/0x68 > [<ffffffff813c5544>] dev_attr_store+0x18/0x22 > [<ffffffff811dac6c>] sysfs_kf_write+0x49/0x51 > [<ffffffff811da139>] kernfs_fop_write+0x105/0x158 > [<ffffffff8116c54f>] __vfs_write+0x28/0xbd > [<ffffffff812ab014>] ? security_file_permission+0x23/0x90 > [<ffffffff8116ccb2>] vfs_write+0xb2/0x169 > [<ffffffff8116d717>] SyS_write+0x4a/0x91 > [<ffffffff8153d12e>] entry_SYSCALL_64_fastpath+0x12/0x76 > > triggered when offlining a CPU, e.g. via sysfs. > > Signed-off-by: Jan Kiszka <jan.kiszka@...mens.com> > --- > kernel/time/timer.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/kernel/time/timer.c b/kernel/time/timer.c > index 520499d..c826178 100644 > --- a/kernel/time/timer.c > +++ b/kernel/time/timer.c > @@ -1566,7 +1566,7 @@ static void migrate_timers(int cpu) > > BUG_ON(cpu_online(cpu)); > old_base = per_cpu_ptr(&tvec_bases, cpu); > - new_base = this_cpu_ptr(&tvec_bases); > + new_base = &get_cpu_var(tvec_bases); Hmm, tglx's version doesn't disable preemtion around it: http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?h=timers/urgent&id=24bfcb100959c8641a627b5604d967243f8f240c -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists