linux-kernel - Re: [PATCH 1/2] x86/cpu/topology: don't write to immutable cpu_present

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87ttkc6kwx.ffs@tglx>
Date: Mon, 08 Apr 2024 15:31:10 +0200
From: Thomas Gleixner <tglx@...utronix.de>
To: Alexey Dobriyan <adobriyan@...il.com>
Cc: adobriyan@...il.com, mingo@...hat.com, bp@...en8.de,
 dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
 linux-kernel@...r.kernel.org, peterz@...radead.org,
 Jonathan.Cameron@...wei.com, linuxarm@...wei.com, linux@...ck-us.net,
 Jonathan Cameron <Jonathan.Cameron@...wei.com>
Subject: Re: [PATCH 1/2] x86/cpu/topology: don't write to immutable
 cpu_present_mask

On Sun, Apr 07 2024 at 18:26, Alexey Dobriyan wrote:
> Workaround the following oops:
>
> 	topology_hotplug_apic
> 	topo_set_cpuids
> 		set_cpu_possible(cpu, true);
> 		// write to __ro_after_init section after init

Duh, yes.

> adobriyan: I'm not sure what's going on, can it set unset bit here?
> If not, then why does it repeat the job and set already set bits.
>
> Anyhow, let's not oops peoples' machines for now.

Adding a bandaid to paper over the non-understood real problem is
definitely not a good plan. I take this patch as a bug report.

Proper fix below.

Thanks,

        tglx
---
Subject: x86/topology: Don't update cpu_possible_map in topo_set_cpuids()
From: Thomas Gleixner <tglx@...utronix.de>
Date: Mon, 08 Apr 2024 15:22:01 +0200

topo_set_cpuids() updates cpu_present_map and cpu_possible map. It is
invoked during enumeration and "physical hotplug" operations. In the
latter case this results in a kernel crash because cpu_possible_map is
marked read only after init completes.

There is no reason to update cpu_possible_map in that function. During
enumeration cpu_possible_map is not relevant and gets fully initialized
after enumeration completed. On "physical hotplug" the bit is already set
because the kernel allows only CPUs to be plugged which have been
enumerated and associated to a CPU number during early boot.

Remove the bogus update of cpu_possible_map.

Fixes: 0e53e7b656cf ("x86/cpu/topology: Sanitize the APIC admission logic")
Reported-by: Jonathan Cameron <Jonathan.Cameron@...wei.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
---
 arch/x86/kernel/cpu/topology.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/arch/x86/kernel/cpu/topology.c
+++ b/arch/x86/kernel/cpu/topology.c
@@ -123,7 +123,6 @@ static void topo_set_cpuids(unsigned int
 	early_per_cpu(x86_cpu_to_apicid, cpu) = apic_id;
 	early_per_cpu(x86_cpu_to_acpiid, cpu) = acpi_id;
 #endif
-	set_cpu_possible(cpu, true);
 	set_cpu_present(cpu, true);
 }
 
@@ -210,7 +209,11 @@ static __init void topo_register_apic(u3
 		topo_info.nr_disabled_cpus++;
 	}
 
-	/* Register present and possible CPUs in the domain maps */
+	/*
+	 * Register present and possible CPUs in the domain
+	 * maps. cpu_possible_map will be updated in
+	 * topology_init_possible_cpus() after enumeration is done.
+	 */
 	for (dom = TOPO_SMT_DOMAIN; dom < TOPO_MAX_DOMAIN; dom++)
 		set_bit(topo_apicid(apic_id, dom), apic_maps[dom].map);
 }