linux-kernel - [PATCH] rcu: fix an infinite loop in rcu_gp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 15 Dec 2019 01:52:42 -0500
From:   Qian Cai <cai@....pw>
To:     paulmck@...nel.org, josh@...htriplett.org
Cc:     rostedt@...dmis.org, mathieu.desnoyers@...icios.com,
        jiangshanlai@...il.com, joel@...lfernandes.org, tj@...nel.org,
        rcu@...r.kernel.org, linux-kernel@...r.kernel.org,
        Qian Cai <cai@....pw>
Subject: [PATCH] rcu: fix an infinite loop in rcu_gp_cleanup()

The commit 82150cb53dcb ("rcu: React to callback overload by
aggressively seeking quiescent states") introduced an infinite loop
during boot here,

// Reset overload indication for CPUs no longer overloaded
for_each_leaf_node_cpu_mask(rnp, cpu, rnp->cbovldmask) {
	rdp = per_cpu_ptr(&rcu_data, cpu);
	check_cb_ovld_locked(rdp, rnp);
}

because on an affected machine,

rnp->cbovldmask = 0
rnp->grphi = 127
rnp->grplo = 0

It ends up with "cpu" is always 64 and never be able to get out of the
loop due to "cpu <= rnp->grphi". It is pointless to enter the loop when
the cpumask is 0 as there is no CPU would be able to match it.

Fixes: 82150cb53dcb ("rcu: React to callback overload by aggressively seeking quiescent states")
Signed-off-by: Qian Cai <cai@....pw>
---
 kernel/rcu/rcu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index ab504fbc76ca..fb691ec86df4 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -363,7 +363,7 @@ static inline void rcu_init_levelspread(int *levelspread, const int *levelcnt)
 	((rnp)->grplo + find_next_bit(&(mask), BITS_PER_LONG, (cpu)))
 #define for_each_leaf_node_cpu_mask(rnp, cpu, mask) \
 	for ((cpu) = rcu_find_next_bit((rnp), 0, (mask)); \
-	     (cpu) <= rnp->grphi; \
+	     (cpu) <= rnp->grphi && (mask); \
 	     (cpu) = rcu_find_next_bit((rnp), (cpu) + 1 - (rnp->grplo), (mask)))
 
 /*
-- 
2.21.0 (Apple Git-122.2)