From: Mark Rutland <mark.rutland@arm.com>
To: Qian Cai <quic_qiancai@quicinc.com>,
Valentin Schneider <valentin.schneider@arm.com>
Cc: Will Deacon <will@kernel.org>,
Catalin Marinas <catalin.marinas@arm.com>,
linux-arm-kernel@lists.infradead.org,
Dmitry Vyukov <dvyukov@google.com>,
linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com
Subject: Re: KASAN + CPU soft-hotplug = stack-out-of-bounds at cpuinfo_store_cpu
Date: Mon, 15 Nov 2021 13:50:39 +0000 [thread overview]
Message-ID: <YZJlr50XQExl7NUg@FVFF77S0Q05N.cambridge.arm.com> (raw)
In-Reply-To: <YZI5+83nxZzo00Dy@FVFF77S0Q05N>
On Mon, Nov 15, 2021 at 10:44:11AM +0000, Mark Rutland wrote:
> Hi,
>
> On Fri, Nov 12, 2021 at 11:50:16PM -0500, Qian Cai wrote:
> > FYI, running CPU soft-hotplug with KASAN on arm64 defconfig will
> > always trigger a stack-out-of-bounds below. I am not right sure where
> > exactly KASAN pointed at, so I am just doing the brute-force
> > bisect. The progress so far:
>
> From below it looks like this is on linux-next; I can reproduce this on
> v5.16-rc1 using your config, when hotplugging CPU0 back in.
>
> We used to have issues with stale poison being left on the stack across a
> hotplug, and we fixed that with commit:
>
> e1b77c92981a5222 ("sched/kasan: remove stale KASAN poison after hotplug")
>
> ... but it looks like we no longer call init_idle() for each hotplug since commit:
>
> f1a0a376ca0c4ef1 ("sched/core: Initialize the idle task with preemption disabled")
>
> ... and so don't get the kasan_unpoison_task_stack() call which we want when
> bringing up a CPU, which we used to get by way of idle_thread_get() calling init_idle().
>
> Adding a call to kasan_unpoison_task_stack(idle) within bringup_cpu() gets rid
> of that, and I reckon we want that explciitly *somewhere* on the CPU bringup
> path.
FWIW I sent that out as a patch:
https://lore.kernel.org/linux-arm-kernel/20211115113310.35693-1-mark.rutland@arm.com/
Thanks,
Mark.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
prev parent reply other threads:[~2021-11-15 13:52 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-13 4:50 KASAN + CPU soft-hotplug = stack-out-of-bounds at cpuinfo_store_cpu Qian Cai
2021-11-13 6:07 ` Qian Cai
2021-11-13 6:49 ` Dmitry Vyukov
2021-11-15 13:29 ` Qian Cai
2021-11-15 10:44 ` Mark Rutland
2021-11-15 13:50 ` Mark Rutland [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YZJlr50XQExl7NUg@FVFF77S0Q05N.cambridge.arm.com \
--to=mark.rutland@arm.com \
--cc=catalin.marinas@arm.com \
--cc=dvyukov@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=quic_qiancai@quicinc.com \
--cc=valentin.schneider@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).