linux-kernel - Re: [PATCH 3/9] x86/fpu: Make task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZmlZiHVF8w09mExw@gmail.com>
Date: Wed, 12 Jun 2024 10:17:12 +0200
From: Ingo Molnar <mingo@...nel.org>
To: Oleg Nesterov <oleg@...hat.com>
Cc: Nathan Chancellor <nathan@...nel.org>, linux-kernel@...r.kernel.org,
	Andy Lutomirski <luto@...capital.net>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Dave Hansen <dave@...1.net>, Peter Zijlstra <peterz@...radead.org>,
	Borislav Petkov <bp@...en8.de>, Brian Gerst <brgerst@...il.com>,
	"H . Peter Anvin" <hpa@...or.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Uros Bizjak <ubizjak@...il.com>
Subject: Re: [PATCH 3/9] x86/fpu: Make task_struct::thread constant size


* Oleg Nesterov <oleg@...hat.com> wrote:

> I don't think this can explain the problem reported by Nathan, but.
> 
> On 06/08, Ingo Molnar wrote:
> >
> > +static struct fpu x86_init_fpu __read_mostly;
> > +
> >  static void __init fpu__init_system_early_generic(void)
> >  {
> > +	int this_cpu = smp_processor_id();
> > +
> > +	fpstate_reset(&x86_init_fpu);
> > +	current->thread.fpu = &x86_init_fpu;
> 
> OK,
> 
> > +	per_cpu(fpu_fpregs_owner_ctx, this_cpu) = &x86_init_fpu;
> > +	x86_init_fpu.last_cpu = this_cpu;
> 
> Why? I think it should do
> 
> 	x86_init_fpu.last_cpu = -1;
> 	set_thread_flag(TIF_NEED_FPU_LOAD);
> 
> And the next patch should kill x86_init_fpu altogether, but keep
> TIF_NEED_FPU_LOAD. It should be never cleared if PF_KTHREAD.

So I applied the patch further below on top of:

   4f4a9b399357 x86/fpu: Make task_struct::thread constant size

And Nathan's 32-bit kernel testcase [but running with 1 CPU to simplify it] 
still crashes in a similar fashion in the (first?) modprobe instance with a 
bad FPU state exception:

  x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
  x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
  x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
  x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
  x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
  [...]

  netconsole: network logging started
  cfg80211: Loading compiled-in X.509 certificates for regulatory database
  ------------[ cut here ]------------
  Bad FPU state detected at restore_fpregs_from_fpstate+0x38/0x6c, reinitializing FPU registers.
  WARNING: CPU: 0 PID: 60 at arch/x86/mm/extable.c:127 fixup_exception+0x41e/0x45c
  Modules linked in:
  CPU: 0 PID: 60 Comm: modprobe Not tainted 6.10.0-rc2-00003-g4f4a9b399357-dirty #39
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  ...

... and the kernel goes down shortly afterwards - full crashlog attached.

What am I missing?

Thanks,

	Ingo  

===================>

 arch/x86/kernel/fpu/init.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index 4e8d37b5a90b..8f912f564fb1 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -75,12 +75,11 @@ static struct fpu x86_init_fpu __read_mostly;
 
 static void __init fpu__init_system_early_generic(void)
 {
-	int this_cpu = smp_processor_id();
-
 	fpstate_reset(&x86_init_fpu);
 	current->thread.fpu = &x86_init_fpu;
-	per_cpu(fpu_fpregs_owner_ctx, this_cpu) = &x86_init_fpu;
-	x86_init_fpu.last_cpu = this_cpu;
+
+	x86_init_fpu.last_cpu = -1;
+	set_thread_flag(TIF_NEED_FPU_LOAD);
 
 	if (!boot_cpu_has(X86_FEATURE_CPUID) &&
 	    !test_bit(X86_FEATURE_FPU, (unsigned long *)cpu_caps_cleared)) {

View attachment "crash.log" of type "text/plain" (25097 bytes)