All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Russell King (Oracle)" <linux@armlinux.org.uk>
To: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Tony Lindgren <tony@atomide.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Linux ARM <linux-arm-kernel@lists.infradead.org>
Subject: Re: [PATCH] ARM: spectre-v2: fix smp_processor_id() warning
Date: Wed, 22 Jun 2022 12:21:16 +0100	[thread overview]
Message-ID: <YrL7LIfOqtEJMoTX@shell.armlinux.org.uk> (raw)
In-Reply-To: <795c9463-452e-bf64-1cc0-c318ccecb1da@I-love.SAKURA.ne.jp>

On Wed, Jun 22, 2022 at 03:49:21PM +0900, Tetsuo Handa wrote:
> syzbot complains smp_processor_id() from harden_branch_predictor()
>  from page fault path [1]. Explicitly disable preemption and use
> raw_smp_processor_id().
> 
> Link: https://syzkaller.appspot.com/bug?extid=a7ee43e564223f195c84 [1]
> Reported-by: syzbot <syzbot+a7ee43e564223f195c84@syzkaller.appspotmail.com>
> Fixes: f5fe12b1eaee220c ("ARM: spectre-v2: harden user aborts in kernel space")
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

This may "fix" the warning, but...

> ---
> This patch is completely untested.
> 
>  arch/arm/include/asm/system_misc.h | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/include/asm/system_misc.h b/arch/arm/include/asm/system_misc.h
> index 98b37340376b..a92446769acd 100644
> --- a/arch/arm/include/asm/system_misc.h
> +++ b/arch/arm/include/asm/system_misc.h
> @@ -20,8 +20,11 @@ typedef void (*harden_branch_predictor_fn_t)(void);
>  DECLARE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
>  static inline void harden_branch_predictor(void)
>  {
> -	harden_branch_predictor_fn_t fn = per_cpu(harden_branch_predictor_fn,
> -						  smp_processor_id());
> +	harden_branch_predictor_fn_t fn;
> +
> +	preempt_disable_notrace();
> +	fn = per_cpu(harden_branch_predictor_fn, raw_smp_processor_id());
> +	preempt_enable_no_resched_notrace();
>  	if (fn)
>  		fn();

The idea is to get the function for the specific CPU, and then to run it
_on_ that CPU, and in theory the CPU that took the fault. However, I
seem to remember there are issues trying to achieve that, and I don't
have a solution for it.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

WARNING: multiple messages have this Message-ID (diff)
From: "Russell King (Oracle)" <linux@armlinux.org.uk>
To: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Tony Lindgren <tony@atomide.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Linux ARM <linux-arm-kernel@lists.infradead.org>
Subject: Re: [PATCH] ARM: spectre-v2: fix smp_processor_id() warning
Date: Wed, 22 Jun 2022 12:21:16 +0100	[thread overview]
Message-ID: <YrL7LIfOqtEJMoTX@shell.armlinux.org.uk> (raw)
In-Reply-To: <795c9463-452e-bf64-1cc0-c318ccecb1da@I-love.SAKURA.ne.jp>

On Wed, Jun 22, 2022 at 03:49:21PM +0900, Tetsuo Handa wrote:
> syzbot complains smp_processor_id() from harden_branch_predictor()
>  from page fault path [1]. Explicitly disable preemption and use
> raw_smp_processor_id().
> 
> Link: https://syzkaller.appspot.com/bug?extid=a7ee43e564223f195c84 [1]
> Reported-by: syzbot <syzbot+a7ee43e564223f195c84@syzkaller.appspotmail.com>
> Fixes: f5fe12b1eaee220c ("ARM: spectre-v2: harden user aborts in kernel space")
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

This may "fix" the warning, but...

> ---
> This patch is completely untested.
> 
>  arch/arm/include/asm/system_misc.h | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/include/asm/system_misc.h b/arch/arm/include/asm/system_misc.h
> index 98b37340376b..a92446769acd 100644
> --- a/arch/arm/include/asm/system_misc.h
> +++ b/arch/arm/include/asm/system_misc.h
> @@ -20,8 +20,11 @@ typedef void (*harden_branch_predictor_fn_t)(void);
>  DECLARE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
>  static inline void harden_branch_predictor(void)
>  {
> -	harden_branch_predictor_fn_t fn = per_cpu(harden_branch_predictor_fn,
> -						  smp_processor_id());
> +	harden_branch_predictor_fn_t fn;
> +
> +	preempt_disable_notrace();
> +	fn = per_cpu(harden_branch_predictor_fn, raw_smp_processor_id());
> +	preempt_enable_no_resched_notrace();
>  	if (fn)
>  		fn();

The idea is to get the function for the specific CPU, and then to run it
_on_ that CPU, and in theory the CPU that took the fault. However, I
seem to remember there are issues trying to achieve that, and I don't
have a solution for it.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

  reply	other threads:[~2022-06-22 11:22 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-22  6:49 [PATCH] ARM: spectre-v2: fix smp_processor_id() warning Tetsuo Handa
2022-06-22  6:49 ` Tetsuo Handa
2022-06-22 11:21 ` Russell King (Oracle) [this message]
2022-06-22 11:21   ` Russell King (Oracle)
2022-06-22 13:31   ` Tetsuo Handa
2022-06-22 13:31     ` Tetsuo Handa
2022-06-22 13:50 ` Marc Zyngier
2022-06-22 13:50   ` Marc Zyngier
2022-06-22 14:04   ` Russell King (Oracle)
2022-06-22 14:04     ` Russell King (Oracle)
2022-06-22 15:02     ` Tetsuo Handa
2022-06-22 15:02       ` Tetsuo Handa
2022-06-24  5:39       ` Tetsuo Handa
2022-06-24  5:39         ` Tetsuo Handa
2022-07-15 13:09         ` [PATCH v2] " Tetsuo Handa
2022-07-15 13:09           ` Tetsuo Handa
2022-07-15 13:36           ` Russell King (Oracle)
2022-07-15 13:36             ` Russell King (Oracle)
2022-07-15 14:07             ` Tetsuo Handa
2022-07-15 14:07               ` Tetsuo Handa

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YrL7LIfOqtEJMoTX@shell.armlinux.org.uk \
    --to=linux@armlinux.org.uk \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=tony@atomide.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.