linux-kernel - Re: [PATCH] x86/mm/pat: Fix missing preemption disable for __native_flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <7590EF40-B0CF-40BD-9D29-FB731A2A2E3A@amacapital.net>
Date:   Fri, 9 Nov 2018 16:22:15 -0800
From:   Andy Lutomirski <luto@...capital.net>
To:     Dan Williams <dan.j.williams@...el.com>
Cc:     tglx@...utronix.de,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Andy Lutomirski <luto@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Borislav Petkov <bp@...en8.de>, stable@...r.kernel.org,
        x86@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86/mm/pat: Fix missing preemption disable for __native_flush_tlb()



> On Nov 9, 2018, at 4:05 PM, Dan Williams <dan.j.williams@...el.com> wrote:
> 
> Commit f77084d96355 "x86/mm/pat: Disable preemption around
> __flush_tlb_all()" addressed a case where __flush_tlb_all() is called
> without preemption being disabled. It also left a warning to catch other
> cases where preemption is not disabled. That warning triggers for the
> memory hotplug path which is also used for persistent memory enabling:

I don’t think I agree with the patch. If you call __flush_tlb_all() in a context where you might be *migrated*, then there’s a bug. We could change the code to allow this particular use by checking that we haven’t done SMP init yet, perhaps.

> 
> WARNING: CPU: 35 PID: 911 at ./arch/x86/include/asm/tlbflush.h:460
> RIP: 0010:__flush_tlb_all+0x1b/0x3a
> [..]
> Call Trace:
>  phys_pud_init+0x29c/0x2bb
>  kernel_physical_mapping_init+0xfc/0x219
>  init_memory_mapping+0x1a5/0x3b0
>  arch_add_memory+0x2c/0x50
>  devm_memremap_pages+0x3aa/0x610
>  pmem_attach_disk+0x585/0x700 [nd_pmem]
> 
> Rather than audit all __flush_tlb_all() callers to add preemption, just
> do it internally to __flush_tlb_all().
> 
> Fixes: f77084d96355 ("x86/mm/pat: Disable preemption around __flush_tlb_all()")
> Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Andy Lutomirski <luto@...nel.org>
> Cc: Dave Hansen <dave.hansen@...ux.intel.com>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Borislav Petkov <bp@...en8.de>
> Cc: <stable@...r.kernel.org>
> Signed-off-by: Dan Williams <dan.j.williams@...el.com>
> ---
> arch/x86/include/asm/tlbflush.h |    8 ++++----
> arch/x86/mm/pageattr.c          |    6 +-----
> 2 files changed, 5 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
> index d760611cfc35..049e0aca0fb5 100644
> --- a/arch/x86/include/asm/tlbflush.h
> +++ b/arch/x86/include/asm/tlbflush.h
> @@ -454,11 +454,10 @@ static inline void __native_flush_tlb_one_user(unsigned long addr)
> static inline void __flush_tlb_all(void)
> {
>    /*
> -     * This is to catch users with enabled preemption and the PGE feature
> -     * and don't trigger the warning in __native_flush_tlb().
> +     *  Preemption needs to be disabled around __flush_tlb* calls
> +     *  due to CR3 reload in __native_flush_tlb().
>     */
> -    VM_WARN_ON_ONCE(preemptible());
> -
> +    preempt_disable();
>    if (boot_cpu_has(X86_FEATURE_PGE)) {
>        __flush_tlb_global();
>    } else {
> @@ -467,6 +466,7 @@ static inline void __flush_tlb_all(void)
>         */
>        __flush_tlb();
>    }
> +    preempt_enable();
> }
> 
> /*
> diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
> index db7a10082238..f799076e3d57 100644
> --- a/arch/x86/mm/pageattr.c
> +++ b/arch/x86/mm/pageattr.c
> @@ -2309,13 +2309,9 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
> 
>    /*
>     * We should perform an IPI and flush all tlbs,
> -     * but that can deadlock->flush only current cpu.
> -     * Preemption needs to be disabled around __flush_tlb_all() due to
> -     * CR3 reload in __native_flush_tlb().
> +     * but that can deadlock->flush only current cpu:
>     */
> -    preempt_disable();
>    __flush_tlb_all();
> -    preempt_enable();
> 
>    arch_flush_lazy_mmu_mode();
> }
>