linux-kernel - [PATCH] x86/mce/AMD: Fix partial SMCA bank init when CPU 0 != thread 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Jun 2017 19:06:30 -0500
From:   Jack Miller <jack@...ezen.org>
To:     linux-kernel@...r.kernel.org
Cc:     tglx@...utronix.de, bp@...e.de, Yazen.Ghannam@....com,
        x86@...nel.org
Subject: [PATCH] x86/mce/AMD: Fix partial SMCA bank init when CPU 0 != thread 0

After a call to firmware SwitchBSP(), Linux can be booted with a thread
that isn't the first in the system. That thread automatically becomes
CPU 0.

Currently get_smca_bank_info() queries CPU 0's MCA types, but if CPU 0
!= hardware thread 0, it will get an incomplete list of MCA types in
smca_banks.

This causes get_name() to return NULL when initing hardware thread 0's
additional types, and then the following error when creating the bank
kobj in threshold_create_bank():

[    1.171552] kobject: can not set name properly!
[    1.171569] kobject_create_and_add: kobject_add error: -12

This error path isn't correctly handled. threshold_init_device() fails,
but later if a thread is offlined, threshold_remove_bank() causes a BUG:

[   67.491772] BUG: unable to handle kernel NULL pointer dereference at           (null)
[   67.491781] IP: mce_threshold_remove_device.part.7+0x82/0x2c0

because per_cpu(threshold_banks, cpu) is unexpectedly NULL.

This patch fixes get_smca_bank_info() to query hardware thread 0, not
necessarily CPU 0, to get a full set of MCA types.

I'm uncertain that reading the APIC ID is correct here, and this will
fail if there is AMD hardware where hardware thread 0's APIC ID != 0,
but the other topology/CPUID based functions don't seem to easily
differentiate CPU 0 and thread 0 or possibly aren't inited at this
point. Suggestions for a better mechanism welcome.

Signed-off-by: Jack Miller <jack@...ezen.org>
---
 arch/x86/kernel/cpu/mcheck/mce_amd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 6e4a047e4b68..9d74adcf34d2 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -170,8 +170,8 @@ static void get_smca_bank_info(unsigned int bank)
 	struct smca_hwid *s_hwid;
 	u32 high, instance_id;

-	/* Collect bank_info using CPU 0 for now. */
-	if (cpu)
+	/* Collect bank_info using hardware thread 0 for now. */
+	if (apic->get_apic_id(apic->read(APIC_ID)) != 0)
 		return;

 	if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_IPID(bank), &instance_id, &high)) {
-- 
2.13.2