linux-kernel - BUG() the kernel via the hotplug target sysfs file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 2 Jun 2017 16:47:52 +0200
From:   Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org
Subject: BUG() the kernel via the hotplug target sysfs file

It is possible to BUG() the kernel via the hotplug target interface via:
|echo 91 > /sys/devices/system/cpu/cpu7/hotplug/target
| Unregister pv shared memory for cpu 7
| ------------[ cut here ]------------
| kernel BUG at kernel/cpu.c:747!

which is:

|  void cpuhp_report_idle_dead(void)
| {
|         struct cpuhp_cpu_state *st = this_cpu_ptr(&cpuhp_state);
| 
=>       BUG_ON(st->state != CPUHP_AP_OFFLINE);
| …
| }

So the states are:
 89: idle:dead
 90: ap:offline
 91: sched:starting
 92: RCU/tree:dying
132: ap:online
133: cpu:teardown

and cpu:teardown (takedown_cpu()) invokes:
 cpu_stopper_thread()
 multi_cpu_stop()
 take_cpu_down()
 native_cpu_disable()
 cpu_disable_common()

which clears the CPU from cpu_online_mask. This means, as things are
now, we can't stop at any state between cpu:teardown and idle:dead.

Sebastian