All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] ARM: Fix incorrect use of smp_processor_id() by syzbot report
@ 2021-03-12  4:12 ` qiang.zhang
  0 siblings, 0 replies; 9+ messages in thread
From: qiang.zhang @ 2021-03-12  4:12 UTC (permalink / raw)
  To: linux; +Cc: akpm, linux-kernel, linux-arm-kernel, syzkaller-bugs

From: Zqiang <qiang.zhang@windriver.com>

BUG: using smp_processor_id() in preemptible [00000000] code:
syz-executor.0/15841
caller is debug_smp_processor_id+0x20/0x24
lib/smp_processor_id.c:64

The smp_processor_id() is used in a code segment when
preemption has been disabled, otherwise, when preemption
is enabled this pointer is usually no longer useful
since it may no longer point to per cpu data of the
current processor.

Reported-by: syzbot <syzbot+a7ee43e564223f195c84@syzkaller.appspotmail.com>
Fixes: f5fe12b1eaee ("ARM: spectre-v2: harden user aborts in kernel space")
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
---
 arch/arm/include/asm/system_misc.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/include/asm/system_misc.h b/arch/arm/include/asm/system_misc.h
index 66f6a3ae68d2..61916dc7d361 100644
--- a/arch/arm/include/asm/system_misc.h
+++ b/arch/arm/include/asm/system_misc.h
@@ -21,8 +21,10 @@ typedef void (*harden_branch_predictor_fn_t)(void);
 DECLARE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
 static inline void harden_branch_predictor(void)
 {
+	preempt_disable();
 	harden_branch_predictor_fn_t fn = per_cpu(harden_branch_predictor_fn,
 						  smp_processor_id());
+	preempt_enable();
 	if (fn)
 		fn();
 }
-- 
2.29.2


^ permalink raw reply related	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2021-03-12  7:52 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-12  4:12 [PATCH] ARM: Fix incorrect use of smp_processor_id() by syzbot report qiang.zhang
2021-03-12  4:12 ` qiang.zhang
2021-03-12  6:30 ` Dmitry Vyukov
2021-03-12  6:30   ` Dmitry Vyukov
2021-03-12  7:50   ` 回复: " Zhang, Qiang
2021-03-12  7:50     ` Zhang, Qiang
2021-03-12  6:32 ` kernel test robot
2021-03-12  6:32   ` kernel test robot
2021-03-12  6:32   ` kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.