From: Kai Huang <kai.huang@intel.com>
To: Borislav Petkov <bp@alien8.de>
Cc: x86@kernel.org, linux-sgx@vger.kernel.org, jarkko@kernel.org,
dave.hansen@linux.intel.com, dave.hansen@intel.com,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] x86/sgx: Avoid returning NULL in __sgx_alloc_epc_page()
Date: Fri, 19 Mar 2021 22:01:41 +1300 [thread overview]
Message-ID: <20210319220141.8bf20c54fdb06c6f93cde448@intel.com> (raw)
In-Reply-To: <20210319084523.GA6251@zn.tnic>
On Fri, 19 Mar 2021 09:45:23 +0100 Borislav Petkov wrote:
> On Fri, Mar 19, 2021 at 05:06:02PM +1300, Kai Huang wrote:
> > Below kernel bug happened when running simple SGX application when EPC
> > is under pressure. The root cause is with commit 5b8719504e3a
> > ("x86/sgx: Add a basic NUMA allocation scheme to sgx_alloc_epc_page()"),
> > __sgx_alloc_epc_page() returns NULL when there's no free EPC page can be
> > allocated, while old behavior was it always returned ERR_PTR(-ENOMEM) in
> > such case.
> >
> > Fix by directly returning the page if __sgx_alloc_epc_page_from_node()
> > allocates a valid page in fallback to non-local allocation, and always
> > returning ERR_PTR(-ENOMEM) if no EPC page can be allocated.
> >
> > [ 253.474764] BUG: kernel NULL pointer dereference, address: 0000000000000008
> > [ 253.500101] #PF: supervisor write access in kernel mode
> > [ 253.525462] #PF: error_code(0x0002) - not-present page
> > ...
> > [ 254.102041] Call Trace:
> > [ 254.126699] sgx_ioc_enclave_add_pages+0x241/0x770
> > [ 254.151305] sgx_ioctl+0x194/0x4b0
> > [ 254.174976] ? handle_mm_fault+0xd0/0x260
> > [ 254.198470] ? do_user_addr_fault+0x1ef/0x570
> > [ 254.221827] __x64_sys_ioctl+0x91/0xc0
> > [ 254.244546] do_syscall_64+0x38/0x90
> > [ 254.266728] entry_SYSCALL_64_after_hwframe+0x44/0xae
> > [ 254.289232] RIP: 0033:0x7fdc4cf4031b
> > ...
> > [ 254.711480] CR2: 0000000000000008
> > [ 254.735494] ---[ end trace 970dce6d4cdf7f64 ]---
> > [ 254.759915] RIP: 0010:sgx_alloc_epc_page+0x46/0x152
> > ...
> >
> > Fixes: 5b8719504e3a("x86/sgx: Add a basic NUMA allocation scheme to sgx_alloc_epc_page()")
> > Signed-off-by: Kai Huang <kai.huang@intel.com>
> > ---
> > arch/x86/kernel/cpu/sgx/main.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
>
> I was on the verge whether to merge that into the original patch since
> it is the top patch on the branch or create a new one but opted for
> former because this way it won't break bisection and people won't have
> to pay attention whether there's a fix patch to the NUMA patch too, in
> case they wanna backport and whatnot.
Sure.
[...]
> +
> + /* Fall back to the non-local NUMA nodes: */
> + while (true) {
> + nid = next_node_in(nid, sgx_numa_mask);
> + if (nid == nid_of_current)
> + break;
>
> - page = __sgx_alloc_epc_page_from_section(section);
> + page = __sgx_alloc_epc_page_from_node(nid);
> if (page)
> return page;
> }
It seems "return ERR_PTR(-ENOMEM)" is missing at the bottom of this function?
next prev parent reply other threads:[~2021-03-19 9:02 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-19 4:06 [PATCH] x86/sgx: Avoid returning NULL in __sgx_alloc_epc_page() Kai Huang
2021-03-19 5:42 ` Jarkko Sakkinen
2021-03-19 8:45 ` Borislav Petkov
2021-03-19 9:01 ` Kai Huang [this message]
2021-03-19 9:12 ` Kai Huang
2021-03-19 14:50 ` Jarkko Sakkinen
2021-03-19 14:59 ` Borislav Petkov
2021-03-19 15:22 ` Jarkko Sakkinen
2021-03-19 15:52 ` Borislav Petkov
2021-03-19 15:59 ` Dave Hansen
2021-03-19 16:09 ` Borislav Petkov
2021-03-19 14:49 ` Jarkko Sakkinen
2021-03-19 18:45 ` [tip: x86/sgx] x86/sgx: Add a basic NUMA allocation scheme to sgx_alloc_epc_page() tip-bot2 for Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210319220141.8bf20c54fdb06c6f93cde448@intel.com \
--to=kai.huang@intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=jarkko@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).