linux-kernel - Re: [PATCH v2] firmware: arm_sdei: Fix sleep from invalid context BUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221107161411.GF21157@willie-the-truck>
Date:   Mon, 7 Nov 2022 16:14:12 +0000
From:   Will Deacon <will@...nel.org>
To:     Pierre Gondois <pierre.gondois@....com>
Cc:     linux-kernel@...r.kernel.org, James Morse <james.morse@....com>,
        Huacai Chen <chenhuacai@...nel.org>,
        John Garry <john.garry@...wei.com>,
        Shaokun Zhang <zhangshaokun@...ilicon.com>,
        WANG Xuerui <git@...0n.name>, Qi Liu <liuqi115@...wei.com>,
        Bharat Bhushan <bbhushan2@...vell.com>,
        Huang Ying <ying.huang@...el.com>,
        Bibo Mao <maobibo@...ngson.cn>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        Daniel Lezcano <daniel.lezcano@...aro.org>,
        linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v2] firmware: arm_sdei: Fix sleep from invalid context BUG

On Tue, Oct 18, 2022 at 03:04:53PM +0200, Pierre Gondois wrote:
> On an Ampere Altra,
> Running a preemp_rt kernel based on v5.19-rc3-rt5 on an
> Ampere Altra triggers:
> [   15.683141] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
> [   15.683154] in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 24, name: cpuhp/0
> [   15.683157] preempt_count: 0, expected: 0
> [   15.683159] RCU nest depth: 0, expected: 0
> [   15.683163] 3 locks held by cpuhp/0/24:
> [   15.683167]  #0: ffffda30217c70d0 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
> [   15.683201]  #1: ffffda30217c7120 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
> [   15.683205]  #2: ffffda3021c711f0 (sdei_list_lock){....}-{3:3}, at: sdei_cpuhp_up+0x3c/0x130
> [   15.683224] irq event stamp: 36
> [   15.683226] hardirqs last  enabled at (35): [<ffffda301e85b7bc>] finish_task_switch+0xb4/0x2b0
> [   15.683236] hardirqs last disabled at (36): [<ffffda301e812fec>] cpuhp_thread_fun+0x21c/0x248
> [   15.683238] softirqs last  enabled at (0): [<ffffda301e80b184>] copy_process+0x63c/0x1ac0
> [   15.683245] softirqs last disabled at (0): [<0000000000000000>] 0x0
> [   15.683258] CPU: 0 PID: 24 Comm: cpuhp/0 Not tainted 5.19.0-rc3-rt5-[...]
> [   15.683265] Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18
> [   15.683268] Call trace:
> [   15.683271]  dump_backtrace+0x114/0x120
> [   15.683277]  show_stack+0x20/0x70
> [   15.683279]  dump_stack_lvl+0x9c/0xd8
> [   15.683288]  dump_stack+0x18/0x34
> [   15.683289]  __might_resched+0x188/0x228
> [   15.683292]  rt_spin_lock+0x70/0x120
> [   15.683301]  sdei_cpuhp_up+0x3c/0x130
> [   15.683303]  cpuhp_invoke_callback+0x250/0xf08
> [   15.683305]  cpuhp_thread_fun+0x120/0x248
> [   15.683308]  smpboot_thread_fn+0x280/0x320
> [   15.683315]  kthread+0x130/0x140
> [   15.683321]  ret_from_fork+0x10/0x20
> 
> sdei_cpuhp_up() is called in the STARTING hotplug section,
> which runs whith interrupts disabled. Move CPUHP_AP_ARM_SDEI_
> state to the _ONLINE section to execute the cpuhp cb with
> preemption enabled.
> 
> Some SDEI calls (e.g. SDEI_1_0_FN_SDEI_PE_MASK) take actions on the
> calling CPU. It is checked that preemption is disabled for them.
> _ONLINE cpuhp cb are executed in the 'per CPU hotplug thread'.
> Preemption is enabled in those threads, but their cpumask is limited
> to 1 CPU.
> Move 'WARN_ON_ONCE(preemptible())' statements so that SDEI cpuhp cb
> don't trigger them. This means that no check will be done for some
> cases, e.g. sdei_mask_local_cpu() invocations.
> 
> Also add a check for the SDEI_1_0_FN_SDEI_PRIVATE_RESET SDEI call
> which acts on the calling CPU.
> 
> Suggested-by: James Morse <james.morse@....com>
> Signed-off-by: Pierre Gondois <pierre.gondois@....com>
> ---
>  drivers/firmware/arm_sdei.c | 28 ++++++++++++++--------------
>  include/linux/cpuhotplug.h  |  2 +-
>  2 files changed, 15 insertions(+), 15 deletions(-)

James -- are you taking care of this one, or should I queue it via arm64?

Will