From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755229AbbF0LUG (ORCPT ); Sat, 27 Jun 2015 07:20:06 -0400 Received: from mout.web.de ([212.227.15.3]:63829 "EHLO mout.web.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752544AbbF0LT4 (ORCPT ); Sat, 27 Jun 2015 07:19:56 -0400 Message-ID: <558E86BC.6070405@web.de> Date: Sat, 27 Jun 2015 13:19:24 +0200 From: Jan Kiszka User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.8.1.12) Gecko/20080226 SUSE/2.0.0.12-1.1 Thunderbird/2.0.0.12 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: Borislav Petkov CC: Thomas Gleixner , LKML , Ingo Molnar , Peter Zijlstra , Paul McKenney , Frederic Weisbecker , Eric Dumazet , Viresh Kumar , John Stultz , Joonwoo Park , Wenbo Wang , Steven Rostedt , Badhri Jagan Sridharan Subject: Re: [PATCH] timer: Fix unsafe cpu variable access in migrate_timers References: <20150526210723.245729529@linutronix.de> <20150526224511.950084301@linutronix.de> <558E7325.70505@web.de> <20150627110046.GC27131@pd.tnic> In-Reply-To: <20150627110046.GC27131@pd.tnic> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="9nN6QbCP3b3rf9CPfUlru5rwXSbVQJnHM" X-Provags-ID: V03:K0:M47ejkG/Rx9x+CUJTr71EyZWF5ygYnpRpXNPpZt90I7FsZzCNGU eRuGo/c2IhbaTvX2tSmX+zg7RVpJ0ql/WhNa+rOUxm1N3dIQl/Fz2KaXTxJ2i9oGAU8PtZ3 ypAX7oqDatla94SkTcQlEF11HnPy2QJWMpqLp/upVbJreC+zg+ylHNFzn1HLY+xUF2YUR87 QBQ5PHpCHAzlKNkU28T+Q== X-UI-Out-Filterresults: notjunk:1;V01:K0:CceOGySLi48=:2DFg/p3Sz/98DXxF8K95IK gb9+lKotkknnCDv9FXN5OJniTFJMFqmrNcJ5ePADzxNZOEcjGQZisGlR1kiPVEQQ6480BzRpT SE3DPS+Pmd/5sSxq0IAs1vafpvitCW6/edu9cjPYnk7LpfJg2ibW0nKEYXQpFOaj+NTQH472H ulQIfQwQiqeg6hj0ioy6uX8E7EPs0tV6vaTNsERvDJQGZQaySFjfaAGyfGLINPZXzvHxDVNSU 8SbIqVRV9LX+999T5CHVhMiohj7cPm0/rW/1lQ2L2Pbj75iLQEbHyHNILS+IwpCIWO55yBEbJ ltmkw+Hz/px173GwrllhMmmcAogVHHTAv41lfyFgoP+Sddjft2DgwA7I4ykNFxplO2U6Nikvu fGbMlpYNjx2KXy+BabLRmvp8ObLPv+6M/AiB70JJOtLrjfD12OJsRPbsZPdQAiRhWaEnFg25g ROPP5j+W32G4Gv0OkNJo7KKuhLovAtyHc2KvLUyDsG+XzPrDPSZFEwgxdZtajhZ4rwoRiOLjw feH8B7fnw8eSGC14xQ0gdij+zUh9RmuGLa53GvJWARE+dIQQZkTtfSz0GytVAPfCk5ZWnnNWs SITFExT+snM9IuYgTxckWrtLwXf4vOPb+uJ1PZRvt68nA1dWAayqUDvz/RjoftkMwe1Beek3m PfIFTwDbaYrWerI/xxO+I+F6zrTw/2jU/xJ1GKnaWyukvzg== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --9nN6QbCP3b3rf9CPfUlru5rwXSbVQJnHM Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 2015-06-27 13:00, Borislav Petkov wrote: > On Sat, Jun 27, 2015 at 11:55:49AM +0200, Jan Kiszka wrote: >> From: Jan Kiszka >> >> migrate_timers is invoked with preemption enabled. Therefore we have t= o >> get/put the cpu-local variable tvec_bases like before commit 0eeda71bc= 3. >> >> This fixes >> >> BUG: using smp_processor_id() in preemptible [00000000] code: bash/491= 7 >> caller is debug_smp_processor_id+0x17/0x19 >> CPU: 0 PID: 4917 Comm: bash Not tainted 4.1.0-dbg+ #97 >> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.8.1-0-g= 4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014 >> ffff880038674040 ffff880002e6fb98 ffffffff815356a0 0000000000000002 >> 0000000000000000 ffff880002e6fbc8 ffffffff8130c16f ffff88003fd8d500 >> 000000000000d500 0000000000000000 0000000000000003 ffff880002e6fbd8 >> Call Trace: >> [] dump_stack+0x4f/0x7b >> [] check_preemption_disabled+0xdd/0xef >> [] debug_smp_processor_id+0x17/0x19 >> [] timer_cpu_notify+0x4f/0x112 >> [] notifier_call_chain+0x4c/0x71 >> [] __raw_notifier_call_chain+0xe/0x10 >> [] __cpu_notify+0x20/0x37 >> [] cpu_notify+0x13/0x15 >> [] cpu_notify_nofail+0xe/0x16 >> [] _cpu_down+0x178/0x268 >> [] ? trace_hardirqs_on+0xd/0xf >> [] cpu_down+0x28/0x3c >> [] cpu_subsys_offline+0x14/0x16 >> [] device_offline+0x7d/0xb1 >> [] online_store+0x48/0x68 >> [] dev_attr_store+0x18/0x22 >> [] sysfs_kf_write+0x49/0x51 >> [] kernfs_fop_write+0x105/0x158 >> [] __vfs_write+0x28/0xbd >> [] ? security_file_permission+0x23/0x90 >> [] vfs_write+0xb2/0x169 >> [] SyS_write+0x4a/0x91 >> [] entry_SYSCALL_64_fastpath+0x12/0x76 >> >> triggered when offlining a CPU, e.g. via sysfs. >> >> Signed-off-by: Jan Kiszka >> --- >> kernel/time/timer.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/kernel/time/timer.c b/kernel/time/timer.c >> index 520499d..c826178 100644 >> --- a/kernel/time/timer.c >> +++ b/kernel/time/timer.c >> @@ -1566,7 +1566,7 @@ static void migrate_timers(int cpu) >> =20 >> BUG_ON(cpu_online(cpu)); >> old_base =3D per_cpu_ptr(&tvec_bases, cpu); >> - new_base =3D this_cpu_ptr(&tvec_bases); >> + new_base =3D &get_cpu_var(tvec_bases); >=20 > Hmm, tglx's version doesn't disable preemtion around it: >=20 > http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?h=3Dtim= ers/urgent&id=3D24bfcb100959c8641a627b5604d967243f8f240c >=20 Oh, there is a fix already. It's just the same: both implicitly disable preemption via get_cpu_ptr/var, look at the macros. Jan --9nN6QbCP3b3rf9CPfUlru5rwXSbVQJnHM Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlWOhrwACgkQitSsb3rl5xR+2gCfUUBGJ/2NF7qbyzs8YHXphfO9 2ZEAoMg6ESMPHEa3Z2qz73HQHJrUTxwx =Trga -----END PGP SIGNATURE----- --9nN6QbCP3b3rf9CPfUlru5rwXSbVQJnHM--