linux-kernel - Re: [PATCH v2] x86,fs/resctrl: Fix NULL pointer dereference when events force disabled while in mbm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <47b9871c-6c08-4bac-bf05-2e6f431beb95@intel.com>
Date: Thu, 16 Oct 2025 11:17:51 -0700
From: Reinette Chatre <reinette.chatre@...el.com>
To: Babu Moger <babu.moger@....com>, <tony.luck@...el.com>,
	<Dave.Martin@....com>, <james.morse@....com>, <tglx@...utronix.de>,
	<mingo@...hat.com>, <bp@...en8.de>, <dave.hansen@...ux.intel.com>
CC: <x86@...nel.org>, <hpa@...or.com>, <linux-kernel@...r.kernel.org>,
	<peternewman@...gle.com>, <eranian@...gle.com>, <gautham.shenoy@....com>
Subject: Re: [PATCH v2] x86,fs/resctrl: Fix NULL pointer dereference when
 events force disabled while in mbm_event mode

Hi Babu,

On 10/16/25 6:34 AM, Babu Moger wrote:
> The following NULL pointer dereference is encountered on mount of resctrl
> fs after booting a system that support assignable counters with the
> "rdt=!mbmtotal,!mbmlocal" kernel parameters:
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000008
> RIP: 0010:mbm_cntr_get
> Call Trace:
> rdtgroup_assign_cntr_event
> rdtgroup_assign_cntrs
> rdt_get_tree
> 
> Specifying the kernel parameter "rdt=!mbmtotal,!mbmlocal" effectively
> disables the legacy X86_FEATURE_CQM_MBM_TOTAL and X86_FEATURE_CQM_MBM_LOCAL
> features and thus the MBM events they represent. This results in the
> per-domain MBM event related data structures to not be allocated during
> resctrl early initialization.
> 
> resctrl fs initialization follows by implicitly enabling both MBM total and
> local events on a system that supports assignable counters (mbm_event
> mode), but this enabling occurs after the per-domain data structures have
> been created.
> 
> During runtime resctrl fs assumes that an enabled event can access all its
> state.  This results in NULL pointer dereference when resctrl attempts to
> access the un-allocated structures of an enabled event.
> 
> Remove the late MBM event enabling from resctrl fs.
> 
> This leaves a problem where the X86_FEATURE_CQM_MBM_TOTAL and
> X86_FEATURE_CQM_MBM_LOCAL features may be disabled while assignable
> counter (mbm_event) mode is enabled without any events to support.
> Switching between the "default" and "mbm_event" mode without any events
> is not practical.
> 
> Create a dependency between the
> X86_FEATURE_CQM_MBM_TOTAL/X86_FEATURE_CQM_MBM_LOCAL and X86_FEATURE_ABMC
> (assignable counter) hardware features. An x86 system that supports
> assignable counters now requires support of X86_FEATURE_CQM_MBM_TOTAL or
> X86_FEATURE_CQM_MBM_LOCAL.  This ensures all needed MBM related data
> structures are created before use and that it is only possible to switch
> between "default" and "mbm_event" mode when the same events are available
> in both modes. This dependency does not exist in the hardware but this
> usage of these feature settings work for known systems.
> 
> Fixes: 13390861b426e ("x86,fs/resctrl: Detect Assignable Bandwidth Monitoring feature details")
> Co-developed-by: Reinette Chatre <reinette.chatre@...el.com>
> Signed-off-by: Reinette Chatre <reinette.chatre@...el.com>
> Signed-off-by: Babu Moger <babu.moger@....com>
> ---

Thank you very much.

Reviewed-by: Reinette Chatre <reinette.chatre@...el.com>

Reinette