From: Jan Kiszka <jan.kiszka@web.de>
To: Borislav Petkov <bp@alien8.de>
Cc: Thomas Gleixner <tglx@linutronix.de>,
LKML <linux-kernel@vger.kernel.org>,
Ingo Molnar <mingo@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Paul McKenney <paulmck@linux.vnet.ibm.com>,
Frederic Weisbecker <fweisbec@gmail.com>,
Eric Dumazet <edumazet@google.com>,
Viresh Kumar <viresh.kumar@linaro.org>,
John Stultz <john.stultz@linaro.org>,
Joonwoo Park <joonwoop@codeaurora.org>,
Wenbo Wang <wenbo.wang@memblaze.com>,
Steven Rostedt <rostedt@goodmis.org>,
Badhri Jagan Sridharan <Badhri@google.com>
Subject: Re: [PATCH] timer: Fix unsafe cpu variable access in migrate_timers
Date: Sat, 27 Jun 2015 13:19:24 +0200 [thread overview]
Message-ID: <558E86BC.6070405@web.de> (raw)
In-Reply-To: <20150627110046.GC27131@pd.tnic>
[-- Attachment #1: Type: text/plain, Size: 3032 bytes --]
On 2015-06-27 13:00, Borislav Petkov wrote:
> On Sat, Jun 27, 2015 at 11:55:49AM +0200, Jan Kiszka wrote:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> migrate_timers is invoked with preemption enabled. Therefore we have to
>> get/put the cpu-local variable tvec_bases like before commit 0eeda71bc3.
>>
>> This fixes
>>
>> BUG: using smp_processor_id() in preemptible [00000000] code: bash/4917
>> caller is debug_smp_processor_id+0x17/0x19
>> CPU: 0 PID: 4917 Comm: bash Not tainted 4.1.0-dbg+ #97
>> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
>> ffff880038674040 ffff880002e6fb98 ffffffff815356a0 0000000000000002
>> 0000000000000000 ffff880002e6fbc8 ffffffff8130c16f ffff88003fd8d500
>> 000000000000d500 0000000000000000 0000000000000003 ffff880002e6fbd8
>> Call Trace:
>> [<ffffffff815356a0>] dump_stack+0x4f/0x7b
>> [<ffffffff8130c16f>] check_preemption_disabled+0xdd/0xef
>> [<ffffffff8130c198>] debug_smp_processor_id+0x17/0x19
>> [<ffffffff810a9b37>] timer_cpu_notify+0x4f/0x112
>> [<ffffffff8106718b>] notifier_call_chain+0x4c/0x71
>> [<ffffffff810671be>] __raw_notifier_call_chain+0xe/0x10
>> [<ffffffff810484b6>] __cpu_notify+0x20/0x37
>> [<ffffffff810484e0>] cpu_notify+0x13/0x15
>> [<ffffffff81048591>] cpu_notify_nofail+0xe/0x16
>> [<ffffffff8152efb2>] _cpu_down+0x178/0x268
>> [<ffffffff8108bc3a>] ? trace_hardirqs_on+0xd/0xf
>> [<ffffffff8152f0ca>] cpu_down+0x28/0x3c
>> [<ffffffff813cbdb9>] cpu_subsys_offline+0x14/0x16
>> [<ffffffff813c779d>] device_offline+0x7d/0xb1
>> [<ffffffff813c78a2>] online_store+0x48/0x68
>> [<ffffffff813c5544>] dev_attr_store+0x18/0x22
>> [<ffffffff811dac6c>] sysfs_kf_write+0x49/0x51
>> [<ffffffff811da139>] kernfs_fop_write+0x105/0x158
>> [<ffffffff8116c54f>] __vfs_write+0x28/0xbd
>> [<ffffffff812ab014>] ? security_file_permission+0x23/0x90
>> [<ffffffff8116ccb2>] vfs_write+0xb2/0x169
>> [<ffffffff8116d717>] SyS_write+0x4a/0x91
>> [<ffffffff8153d12e>] entry_SYSCALL_64_fastpath+0x12/0x76
>>
>> triggered when offlining a CPU, e.g. via sysfs.
>>
>> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
>> ---
>> kernel/time/timer.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/kernel/time/timer.c b/kernel/time/timer.c
>> index 520499d..c826178 100644
>> --- a/kernel/time/timer.c
>> +++ b/kernel/time/timer.c
>> @@ -1566,7 +1566,7 @@ static void migrate_timers(int cpu)
>>
>> BUG_ON(cpu_online(cpu));
>> old_base = per_cpu_ptr(&tvec_bases, cpu);
>> - new_base = this_cpu_ptr(&tvec_bases);
>> + new_base = &get_cpu_var(tvec_bases);
>
> Hmm, tglx's version doesn't disable preemtion around it:
>
> http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?h=timers/urgent&id=24bfcb100959c8641a627b5604d967243f8f240c
>
Oh, there is a fix already. It's just the same: both implicitly disable
preemption via get_cpu_ptr/var, look at the macros.
Jan
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
next prev parent reply other threads:[~2015-06-27 11:20 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-26 22:50 [patch 0/7] timers: Footprint diet and NOHZ overhead mitigation Thomas Gleixner
2015-05-26 22:50 ` [patch 1/7] timers: Sanitize catchup_timer_jiffies() usage Thomas Gleixner
2015-05-27 5:39 ` Viresh Kumar
2015-06-19 13:22 ` [tip:timers/core] " tip-bot for Thomas Gleixner
2015-05-26 22:50 ` [patch 2/7] timer: Remove FIFO guarantee Thomas Gleixner
2015-05-27 9:11 ` Viresh Kumar
2015-06-19 13:22 ` [tip:timers/core] timer: Remove FIFO "guarantee" tip-bot for Thomas Gleixner
2015-05-26 22:50 ` [patch 3/7] timer: Use hlist for the timer wheel hash buckets Thomas Gleixner
2015-05-27 9:13 ` Viresh Kumar
2015-06-19 13:23 ` [tip:timers/core] " tip-bot for Thomas Gleixner
2015-05-26 22:50 ` [patch 4/7] timer: Replace timer base by a cpu index Thomas Gleixner
2015-05-27 9:22 ` Viresh Kumar
2015-05-27 12:09 ` Peter Zijlstra
2015-06-02 13:58 ` Thomas Gleixner
2015-06-19 13:23 ` [tip:timers/core] " tip-bot for Thomas Gleixner
2015-06-27 9:55 ` [PATCH] timer: Fix unsafe cpu variable access in migrate_timers Jan Kiszka
2015-06-27 11:00 ` Borislav Petkov
2015-06-27 11:19 ` Jan Kiszka [this message]
2015-06-27 11:25 ` Borislav Petkov
2015-05-26 22:50 ` [patch 5/7] timer: stats: Simplify the flags handling Thomas Gleixner
2015-06-19 13:23 ` [tip:timers/core] timer: Stats: " tip-bot for Thomas Gleixner
2015-05-26 22:50 ` [patch 6/7] timer: Reduce timer migration overhead if disabled Thomas Gleixner
2015-06-19 13:23 ` [tip:timers/core] " tip-bot for Thomas Gleixner
2015-05-26 22:50 ` [patch 7/7] timer: Minimize nohz off overhead Thomas Gleixner
2015-06-19 13:24 ` [tip:timers/core] " tip-bot for Thomas Gleixner
2015-05-27 14:53 ` [patch 0/7] timers: Footprint diet and NOHZ overhead mitigation Eric Dumazet
2015-06-02 13:58 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=558E86BC.6070405@web.de \
--to=jan.kiszka@web.de \
--cc=Badhri@google.com \
--cc=bp@alien8.de \
--cc=edumazet@google.com \
--cc=fweisbec@gmail.com \
--cc=john.stultz@linaro.org \
--cc=joonwoop@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=paulmck@linux.vnet.ibm.com \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=viresh.kumar@linaro.org \
--cc=wenbo.wang@memblaze.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).