linux-kernel - Re: [PATCH v2 1/1] drivers: base: cacheinfo: fix shared_cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9cfb3356-3e3b-e9f3-1e16-ff02790e5829@arm.com>
Date:   Wed, 21 Dec 2022 10:00:39 +0100
From:   Pierre Gondois <pierre.gondois@....com>
To:     Yong-Xuan Wang <yongxuan.wang@...ive.com>
Cc:     Sudeep Holla <sudeep.holla@....com>,
        Vincent Chen <vincent.chen@...ive.com>,
        Greentime Hu <greentime.hu@...ive.com>,
        linux-kernel@...r.kernel.org,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH v2 1/1] drivers: base: cacheinfo: fix shared_cpu_map

Hello Yong-Xuan,
Except for the nit below, I tried the patch and everything seemed ok, so
with that:
Reviewed-by: Pierre Gondois <pierre.gondois@....com>

Regards,
Pierre

On 12/19/22 11:51, Yong-Xuan Wang wrote:
> The cacheinfo sets up the shared_cpu_map by checking whether the caches
> with the same index are shared between CPUs. However, this will trigger
> slab-out-of-bounds access if the CPUs do not have the same cache hierarchy.
> Another problem is the mismatched shared_cpu_map when the shared cache does
> not have the same index between CPUs.
> 
> CPU0	I	D	L3
> index	0	1	2	x
> 	^	^	^	^
> index	0	1	2	3
> CPU1	I	D	L2	L3
> 
> This patch checks each cache is shared with all caches on other CPUs.
> 
> Signed-off-by: Yong-Xuan Wang <yongxuan.wang@...ive.com>
> ---
>   drivers/base/cacheinfo.c | 25 +++++++++++++++----------
>   1 file changed, 15 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
> index 950b22cdb5f7..d38f80f6fff1 100644
> --- a/drivers/base/cacheinfo.c
> +++ b/drivers/base/cacheinfo.c
> @@ -256,7 +256,7 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)
>   {
>   	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
>   	struct cacheinfo *this_leaf, *sib_leaf;
> -	unsigned int index;
> +	unsigned int index, sib_index;
>   	int ret = 0;
>   
>   	if (this_cpu_ci->cpu_map_populated)
> @@ -284,11 +284,12 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)
>   
>   			if (i == cpu || !sib_cpu_ci->info_list)
>   				continue;/* skip if itself or no cacheinfo */
> -
> -			sib_leaf = per_cpu_cacheinfo_idx(i, index);
> -			if (cache_leaves_are_shared(this_leaf, sib_leaf)) {
> -				cpumask_set_cpu(cpu, &sib_leaf->shared_cpu_map);
> -				cpumask_set_cpu(i, &this_leaf->shared_cpu_map);
> +			for (sib_index = 0; sib_index < cache_leaves(i); sib_index++) {
> +				sib_leaf = per_cpu_cacheinfo_idx(i, sib_index);;

It seems there are 2 ';' above (same in the block below).

> +				if (cache_leaves_are_shared(this_leaf, sib_leaf)) {
> +					cpumask_set_cpu(cpu, &sib_leaf->shared_cpu_map);
> +					cpumask_set_cpu(i, &this_leaf->shared_cpu_map);
> +				}
>   			}
>   		}
>   		/* record the maximum cache line size */
> @@ -302,7 +303,7 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)
>   static void cache_shared_cpu_map_remove(unsigned int cpu)
>   {
>   	struct cacheinfo *this_leaf, *sib_leaf;
> -	unsigned int sibling, index;
> +	unsigned int sibling, index, sib_index;
>   
>   	for (index = 0; index < cache_leaves(cpu); index++) {
>   		this_leaf = per_cpu_cacheinfo_idx(cpu, index);
> @@ -313,9 +314,13 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
>   			if (sibling == cpu || !sib_cpu_ci->info_list)
>   				continue;/* skip if itself or no cacheinfo */
>   
> -			sib_leaf = per_cpu_cacheinfo_idx(sibling, index);
> -			cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map);
> -			cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map);
> +			for (sib_index = 0; sib_index < cache_leaves(sibling); sib_index++) {
> +				sib_leaf = per_cpu_cacheinfo_idx(sibling, sib_index);;
> +				if (cache_leaves_are_shared(this_leaf, sib_leaf)) {
> +					cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map);
> +					cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map);
> +				}
> +			}
>   		}
>   	}
>   }