linux-kernel - Re: [patch 4/6] x86/smp: Cure kexec() vs. mwait_play

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 3 Jun 2023 13:54:19 -0700
From:   Ashok Raj <ashok.raj@...el.com>
To:     Thomas Gleixner <tglx@...utronix.de>
CC:     LKML <linux-kernel@...r.kernel.org>, <x86@...nel.org>,
        Ashok Raj <ashok.raj@...ux.intel.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "Tony Luck" <tony.luck@...el.com>,
        Arjan van de Veen <arjan@...ux.intel.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Eric Biederman <ebiederm@...ssion.com>,
        Ashok Raj <ashok.raj@...el.com>
Subject: Re: [patch 4/6] x86/smp: Cure kexec() vs. mwait_play_dead() breakage

On Sat, Jun 03, 2023 at 10:07:01PM +0200, Thomas Gleixner wrote:
> TLDR: It's a mess.
> 
> When kexec() is executed on a system with "offline" CPUs, which are parked
> in mwait_play_dead() it can end up in a triple fault during the bootup of
> the kexec kernel or cause hard to diagnose data corruption.
> 
> The reason is that kexec() eventually overwrites the previous kernels text,
> page tables, data and stack, If it writes to the cache line which is
> monitored by an previously offlined CPU, MWAIT resumes execution and ends
> up executing the wrong text, dereferencing overwritten page tables or
> corrupting the kexec kernels data.
> 
> Cure this by bringing the offline CPUs out of MWAIT into HLT.
> 
> Write to the monitored cache line of each offline CPU, which makes MWAIT
> resume execution. The written control word tells the offline CPUs to issue
> HLT, which does not have the MWAIT problem.
> 
> That does not help, if a stray NMI, MCE or SMI hits the offline CPUs as
> those make it come out of HLT.
> 
> A follow up change will put them into INIT, which protects at least against
> NMI and SMI.
> 
> Fixes: ea53069231f9 ("x86, hotplug: Use mwait to offline a processor, fix the legacy case")
> Reported-by: Ashok Raj <ashok.raj@...el.com>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>

Does this need a stable tag?

Reviewed-by: Ashok Raj <ashok.raj@...el.com>
Tested-by: Ashok Raj <ashok.raj@...el.com>