linux-kernel - Re: [PATCH 1/2] x86/crash: Disable virt in core NMI crash handler to avoid double list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yn0WPBGGI4VcbM4S@google.com>
Date:   Thu, 12 May 2022 14:14:20 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
        "Guilherme G . Piccoli" <gpiccoli@...lia.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [PATCH 1/2] x86/crash: Disable virt in core NMI crash handler to
 avoid double list_add

On Thu, May 12, 2022, Thomas Gleixner wrote:
> Sean,
> 
> On Wed, May 11 2022 at 23:43, Sean Christopherson wrote:
> > @@ -840,6 +858,20 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback)
> >  	unsigned long msecs;
> >  	local_irq_disable();
> >  
> > +	/*
> > +	 * Invoking multiple callbacks is not currently supported, registering
> > +	 * the NMI handler twice will cause a list_add() double add BUG().
> > +	 * The exception is the "nop" handler in the emergency reboot path,
> > +	 * which can run after e.g. kdump's shootdown.  Do nothing if the crash
> > +	 * handler has already run, i.e. has already prepared other CPUs, the
> > +	 * reboot path doesn't have any work of its to do, it just needs to
> > +	 * ensure all CPUs have prepared for reboot.
> 
> This is confusing at best. The double list add is just one part of the
> problem, which would be trivial enough to fix.
> 
> The real point is that after the first shoot down all other CPUs are
> stuck in crash_nmi_callback() and won't respond to the second NMI.

Well that's embarrasingly obvious in hindsight.

> 
> So trying to run this twice is completely pointless and guaranteed to
> run into the timeout.
> 
> > +	 */
> > +	if (shootdown_callback) {
> > +		WARN_ON_ONCE(callback != nmi_shootdown_nop);
> > +		return;
> 
> Instead of playing games with the callback pointer, I prefer to make
> this all explicit. Delta patch below.

Much better.  If you're planning on doing fixup, can you also include a comment
tweak about why the callback is left set?  If not, I'll do it in v2.  A bit
overkill, but it's another thing that for me was obvious only once I realized "why".

Thanks!

diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 4e3a839ae146..808d3e75fb2d 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -896,7 +896,11 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback)
                msecs--;
        }
 
-       /* Leave the nmi callback set */
+       /*
+        * Leave the nmi callback set, shootdown is a one-time thing.  Clearing
+        * the callback could result in a NULL pointer dereference if a CPU
+        * (finally) responds after the timeout expires.
+        */
 }
 
 static inline void nmi_shootdown_cpus_on_restart(void)