linux-kernel - Re: [PATCH] x86/intel: Fix always false range check in x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a1044e00-8e61-4de5-b22a-3878920e471a@intel.com>
Date: Mon, 28 Jul 2025 11:56:18 -0700
From: Sohil Mehta <sohil.mehta@...el.com>
To: Suchit Karunakaran <suchitkarunakaran@...il.com>, <tglx@...utronix.de>,
	<mingo@...hat.com>, <bp@...en8.de>, <dave.hansen@...ux.intel.com>,
	<hpa@...or.com>, <darwi@...utronix.de>, <peterz@...radead.org>,
	<ravi.bangoria@....com>
CC: <skhan@...uxfoundation.org>, <linux-kernel-mentees@...ts.linux.dev>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86/intel: Fix always false range check in x86_vfm model
 matching

On 7/28/2025 11:09 AM, Suchit Karunakaran wrote:
> Fix a logic bug in early_init_intel() where a conditional range check:
>     (c->x86_vfm >= INTEL_P4_PRESCOTT && c->x86_vfm <= INTEL_P4_WILLAMETTE)
> was always false due to (PRESCOTT) being numerically greater than the
> upper bound (WILLAMETTE). This triggers: -Werror=logical-op: 
> logical ‘and’ of mutually exclusive tests is always false
> The fix corrects the constant ordering to ensure the range is valid:
>     (c->x86_vfm >= INTEL_P4_WILLAMETTE && c->x86_vfm <= INTEL_P4_PRESCOTT)
> 

Thank you for reporting this issue!

This is indeed a bug, but the resolution proposed here seems incorrect.

> Signed-off-by: Suchit Karunakaran <suchitkarunakaran@...il.com>
> ---
>  arch/x86/kernel/cpu/intel.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
> index 076eaa41b8c8..3ec1555cbdc3 100644
> --- a/arch/x86/kernel/cpu/intel.c
> +++ b/arch/x86/kernel/cpu/intel.c
> @@ -262,7 +262,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
>  	if (c->x86_power & (1 << 8)) {
>  		set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
>  		set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
> -	} else if ((c->x86_vfm >= INTEL_P4_PRESCOTT && c->x86_vfm <= INTEL_P4_WILLAMETTE) ||
> +	} else if ((c->x86_vfm >= INTEL_P4_WILLAMETTE && c->x86_vfm <= INTEL_P4_PRESCOTT) ||
>  		   (c->x86_vfm >= INTEL_CORE_YONAH  && c->x86_vfm <= INTEL_IVYBRIDGE)) {
>  		set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
>  	}

See commit fadb6f569b10 ("x86/cpu/intel: Limit the non-architectural
constant_tsc model checks")

The original check that this replaced is:

	if ((c->x86 == 0xf && c->x86_model >= 0x03) ||
		(c->x86 == 0x6 && c->x86_model >= 0x0e))
		set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);

The first check is supposed to cover all P4 models starting with model 3
(INTEL_P4_PRESCOTT). In order to set an upper bound for Family 15, the
check should cover all models until model 6 (INTEL_P4_CEDARMILL) which
is the last model released in that family.

The error that I made was to use an incorrect upper bound. The actual
fix should be this:

s/INTEL_P4_WILLAMETTE/INTEL_P4_CEDARMILL

> @@ -262,7 +262,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
>         if (c->x86_power & (1 << 8)) {
>                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
>                 set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
> -       } else if ((c->x86_vfm >= INTEL_P4_PRESCOTT && c->x86_vfm <= INTEL_P4_WILLAMETTE) ||
> +       } else if ((c->x86_vfm >= INTEL_P4_PRESCOTT && c->x86_vfm <= INTEL_P4_CEDARMILL) ||
>                    (c->x86_vfm >= INTEL_CORE_YONAH  && c->x86_vfm <= INTEL_IVYBRIDGE)) {
>                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
>         }

Also, please add a
Fixes: fadb6f569b10 ("x86/cpu/intel: Limit the non-architectural
constant_tsc model checks")

Thanks,
Sohil