All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Liuye <liu.yeC@h3c.com>,
	Douglas Anderson <dianders@chromium.org>,
	Daniel Thompson <daniel.thompson@linaro.org>
Subject: [PATCH 6.1 41/45] serial: kgdboc: Fix NMI-safety problems from keyboard reset code
Date: Thu, 23 May 2024 15:13:32 +0200	[thread overview]
Message-ID: <20240523130334.037747688@linuxfoundation.org> (raw)
In-Reply-To: <20240523130332.496202557@linuxfoundation.org>

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Thompson <daniel.thompson@linaro.org>

commit b2aba15ad6f908d1a620fd97f6af5620c3639742 upstream.

Currently, when kdb is compiled with keyboard support, then we will use
schedule_work() to provoke reset of the keyboard status.  Unfortunately
schedule_work() gets called from the kgdboc post-debug-exception
handler.  That risks deadlock since schedule_work() is not NMI-safe and,
even on platforms where the NMI is not directly used for debugging, the
debug trap can have NMI-like behaviour depending on where breakpoints
are placed.

Fix this by using the irq work system, which is NMI-safe, to defer the
call to schedule_work() to a point when it is safe to call.

Reported-by: Liuye <liu.yeC@h3c.com>
Closes: https://lore.kernel.org/all/20240228025602.3087748-1-liu.yeC@h3c.com/
Cc: stable@vger.kernel.org
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20240424-kgdboc_fix_schedule_work-v2-1-50f5a490aec5@linaro.org
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/kgdboc.c |   30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

--- a/drivers/tty/serial/kgdboc.c
+++ b/drivers/tty/serial/kgdboc.c
@@ -19,6 +19,7 @@
 #include <linux/console.h>
 #include <linux/vt_kern.h>
 #include <linux/input.h>
+#include <linux/irq_work.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/serial_core.h>
@@ -48,6 +49,25 @@ static struct kgdb_io		kgdboc_earlycon_i
 static int                      (*earlycon_orig_exit)(struct console *con);
 #endif /* IS_BUILTIN(CONFIG_KGDB_SERIAL_CONSOLE) */
 
+/*
+ * When we leave the debug trap handler we need to reset the keyboard status
+ * (since the original keyboard state gets partially clobbered by kdb use of
+ * the keyboard).
+ *
+ * The path to deliver the reset is somewhat circuitous.
+ *
+ * To deliver the reset we register an input handler, reset the keyboard and
+ * then deregister the input handler. However, to get this done right, we do
+ * have to carefully manage the calling context because we can only register
+ * input handlers from task context.
+ *
+ * In particular we need to trigger the action from the debug trap handler with
+ * all its NMI and/or NMI-like oddities. To solve this the kgdboc trap exit code
+ * (the "post_exception" callback) uses irq_work_queue(), which is NMI-safe, to
+ * schedule a callback from a hardirq context. From there we have to defer the
+ * work again, this time using schedule_work(), to get a callback using the
+ * system workqueue, which runs in task context.
+ */
 #ifdef CONFIG_KDB_KEYBOARD
 static int kgdboc_reset_connect(struct input_handler *handler,
 				struct input_dev *dev,
@@ -99,10 +119,17 @@ static void kgdboc_restore_input_helper(
 
 static DECLARE_WORK(kgdboc_restore_input_work, kgdboc_restore_input_helper);
 
+static void kgdboc_queue_restore_input_helper(struct irq_work *unused)
+{
+	schedule_work(&kgdboc_restore_input_work);
+}
+
+static DEFINE_IRQ_WORK(kgdboc_restore_input_irq_work, kgdboc_queue_restore_input_helper);
+
 static void kgdboc_restore_input(void)
 {
 	if (likely(system_state == SYSTEM_RUNNING))
-		schedule_work(&kgdboc_restore_input_work);
+		irq_work_queue(&kgdboc_restore_input_irq_work);
 }
 
 static int kgdboc_register_kbd(char **cptr)
@@ -133,6 +160,7 @@ static void kgdboc_unregister_kbd(void)
 			i--;
 		}
 	}
+	irq_work_sync(&kgdboc_restore_input_irq_work);
 	flush_work(&kgdboc_restore_input_work);
 }
 #else /* ! CONFIG_KDB_KEYBOARD */



  parent reply	other threads:[~2024-05-23 13:21 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-05-23 13:12 [PATCH 6.1 00/45] 6.1.92-rc1 review Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 01/45] drm/amd/display: Fix division by zero in setup_dsc_config Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 02/45] net: ks8851: Fix another TX stall caused by wrong ISR flag handling Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 03/45] ice: pass VSI pointer into ice_vc_isvalid_q_id Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 04/45] ice: remove unnecessary duplicate checks for VF VSI ID Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 05/45] pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 06/45] mfd: stpmic1: Fix swapped mask/unmask in irq chip Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 07/45] nfsd: dont allow nfsd threads to be signalled Greg Kroah-Hartman
2024-05-23 13:12 ` [PATCH 6.1 08/45] KEYS: trusted: Fix memory leak in tpm2_key_encode() Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 09/45] mmc: core: Add HS400 tuning in HS400es initialization Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 10/45] xfs: write page faults in iomap are not buffered writes Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 11/45] xfs: punching delalloc extents on write failure is racy Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 12/45] xfs: use byte ranges for write cleanup ranges Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 13/45] xfs,iomap: move delalloc punching to iomap Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 14/45] iomap: buffered write failure should not truncate the page cache Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 15/45] xfs: xfs_bmap_punch_delalloc_range() should take a byte range Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 16/45] iomap: write iomap validity checks Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 17/45] xfs: use iomap_valid method to detect stale cached iomaps Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 18/45] xfs: drop write error injection is unfixable, remove it Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 19/45] xfs: fix off-by-one-block in xfs_discard_folio() Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 20/45] xfs: fix incorrect error-out in xfs_remove Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 21/45] xfs: fix sb write verify for lazysbcount Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 22/45] xfs: fix incorrect i_nlink caused by inode racing Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 23/45] xfs: invalidate block device page cache during unmount Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 24/45] xfs: attach dquots to inode before reading data/cow fork mappings Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 25/45] xfs: wait iclog complete before tearing down AIL Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 26/45] xfs: fix super block buf log item UAF during force shutdown Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 27/45] xfs: hoist refcount record merge predicates Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 28/45] xfs: estimate post-merge refcounts correctly Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 29/45] xfs: invalidate xfs_bufs when allocating cow extents Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 30/45] xfs: allow inode inactivation during a ro mount log recovery Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 31/45] xfs: fix log recovery when unknown rocompat bits are set Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 32/45] xfs: get root inode correctly at bulkstat Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 33/45] xfs: short circuit xfs_growfs_data_private() if delta is zero Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 34/45] arm64: atomics: lse: remove stale dependency on JUMP_LABEL Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 35/45] drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 36/45] binder: fix max_thread type inconsistency Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 37/45] usb: dwc3: Wait unconditionally after issuing EndXfer command Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 38/45] net: usb: ax88179_178a: fix link status when link is set to down/up Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 39/45] usb: typec: ucsi: displayport: Fix potential deadlock Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 40/45] usb: typec: tipd: fix event checking for tps6598x Greg Kroah-Hartman
2024-05-23 13:13 ` Greg Kroah-Hartman [this message]
2024-05-23 13:13 ` [PATCH 6.1 42/45] remoteproc: mediatek: Make sure IPI buffer fits in L2TCM Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 43/45] KEYS: trusted: Do not use WARN when encode fails Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 44/45] admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET Greg Kroah-Hartman
2024-05-23 13:13 ` [PATCH 6.1 45/45] docs: kernel_include.py: Cope with docutils 0.21 Greg Kroah-Hartman
2024-05-23 17:03 ` [PATCH 6.1 00/45] 6.1.92-rc1 review SeongJae Park
2024-05-23 18:17 ` Mark Brown
2024-05-23 20:21 ` Florian Fainelli
2024-05-24  8:13 ` Anders Roxell
2024-05-24 11:21 ` Pavel Machek
2024-05-24 14:37 ` Shuah Khan
2024-05-24 15:20 ` Jon Hunter
2024-05-24 20:35 ` Mateusz Jończyk
2024-05-24 20:38 ` Ron Economos
2024-05-25  1:06 ` Kelsey Steele
2024-05-25 16:25 ` Allen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240523130334.037747688@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=daniel.thompson@linaro.org \
    --cc=dianders@chromium.org \
    --cc=liu.yeC@h3c.com \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.