linux-kernel - Re: x86/pti: smp_processor_id() called while preemptible in resume-from-sleep

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 30 Dec 2017 10:40:37 -0800
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Dominik Brodowski <linux@...inikbrodowski.net>,
        Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        LKML <linux-kernel@...r.kernel.org>,
        "the arch/x86 maintainers" <x86@...nel.org>
Subject: Re: x86/pti: smp_processor_id() called while preemptible in resume-from-sleep

On Sat, Dec 30, 2017 at 10:20 AM, Thomas Gleixner <tglx@...utronix.de> wrote:
> On Sat, 30 Dec 2017, Dominik Brodowski wrote:
>>
>> native_cpu_up+0x2f0/0xa30:
>> invalidate_user_asid at arch/x86/include/asm/tlbflush.h:343
>
> Ah, that makes sense. Missed that in the maze.
>
> What makes less sense is that tlbflush itself. I'm surely missing something
> subtle, but from a first look that tlbflush is pointless.

Hmm. Regardless of whether the TLB flush makes sense in that
smpboot_setup_warm_reset_vector() location (and I agree that it looks
a bit odd), the warning does look pretty relevant.

The __native_flush_tlb() function looks _very_ broken.

It does:

        invalidate_user_asid(this_cpu_read(cpu_tlbstate.loaded_mm_asid));
        /*
         * If current->mm == NULL then we borrow a mm which may change
         * during a task switch and therefore we must not be preempted
         * while we write CR3 back:
         */
        preempt_disable();
        native_write_cr3(__native_read_cr3());
        preempt_enable();

but why is that preempt-disabled region only around the cr3 write? The
invalidate_user_asid() logic seems to be very CPU-sensitive too.

And even if there is some reason why invalidate_user_asid() really can
do multiple different percpu accesses and it doesn't matter whether
the thread is bouncing around on different cpu's while it does it,
there doesn't seem any _reason_ not to just extend the preempt-disable
over the whole series.

It really looks strange how it does multiple reads (and then a final
write!) to percpu state, when the cpu can change in between.

So I'd suggest moving the preempt_disable() up to the top of that
function, regardless of whether we could then remove that seemingly
stale TLB flush in that crazy
smpboot_setup/restore_warm_reset_vector() dance...

Andy?

                      Linus