From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F24FC433F5 for ; Tue, 16 Nov 2021 16:33:12 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2517961266 for ; Tue, 16 Nov 2021 16:33:12 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 2517961266 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=quicinc.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:CC:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=XLj0WlPtPqDkBwjUm7DgXyhLR2x4BsYG1CZt2nN8+9Q=; b=zipwTQyboTrdJR 3fNVruYTbzeLeKQ0KhkHYtushLZuDAh8WmzbROYhTS46EwFmeGrMInrYtDIJX6Eq1beJcdF0yuzcR 5pWTtGpdEDFtqtcs2RID/tTEe1Xtovk+qk3if5oC9vWxxfoeS4VCniv/x5jHwLRJbMubPXiMpstym +NxQJew2hWrMsY/qO7z293tZffv0oeeJhCysy7sxUjkDMfMdbHPALFnWXfhzVNAnl9Ad8A+BW8ZYd wI7VgcH52oa68BsTNqV8J03/LyTBU08udcEFTLpZjwLcMNahghqpQxrZuG3VRPG5uMybi2zETjTSI IEbfEDU1Q0VD2EGjBavw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mn1N9-002LIk-An; Tue, 16 Nov 2021 16:31:51 +0000 Received: from alexa-out.qualcomm.com ([129.46.98.28]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mn1N5-002LHI-4k for linux-arm-kernel@lists.infradead.org; Tue, 16 Nov 2021 16:31:48 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; i=@quicinc.com; q=dns/txt; s=qcdkim; t=1637080307; x=1668616307; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=k8QLCKX7KLdR2qE03Ri6JtRCS+E7WMMOcwsnXytBH+g=; b=bVE8vz6m+UY1ugxfbqeixnouKApyYeoOJOASqA803RIJuD5toRDMbvxj yrsJoCYUILcSFKyS2YFj0zSoQCmJd1GspmKp23R0o9qu7bzlI5TOivQ8E ksYmPRq5vJRG1/KIukp5UFqtiOX1CBmnRRKTEAXdej25xXiqP3iKFkuez A=; Received: from ironmsg-lv-alpha.qualcomm.com ([10.47.202.13]) by alexa-out.qualcomm.com with ESMTP; 16 Nov 2021 08:31:45 -0800 X-QCInternal: smtphost Received: from nasanex01c.na.qualcomm.com ([10.47.97.222]) by ironmsg-lv-alpha.qualcomm.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Nov 2021 08:31:44 -0800 Received: from nalasex01a.na.qualcomm.com (10.47.209.196) by nasanex01c.na.qualcomm.com (10.47.97.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.922.19; Tue, 16 Nov 2021 08:31:43 -0800 Received: from qian-HP-Z2-SFF-G5-Workstation (10.80.80.8) by nalasex01a.na.qualcomm.com (10.47.209.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.922.19; Tue, 16 Nov 2021 08:31:42 -0800 Date: Tue, 16 Nov 2021 11:31:40 -0500 From: Qian Cai To: Mark Rutland CC: , , , , , , , Subject: Re: [PATCH] Reset task stack state in bringup_cpu() Message-ID: References: <20211115113310.35693-1-mark.rutland@arm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20211115113310.35693-1-mark.rutland@arm.com> X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nalasex01a.na.qualcomm.com (10.47.209.196) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211116_083147_274065_B47161DE X-CRM114-Status: GOOD ( 21.03 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Nov 15, 2021 at 11:33:10AM +0000, Mark Rutland wrote: > To hot unplug a CPU, the idle task on that CPU calls a few layers of C > code before finally leaving the kernel. When KASAN is in use, poisoned > shadow is left around for each of the active stack frames, and when > shadow call stacks are in use. When shadow call stacks are in use the > task's SCS SP is left pointing at an arbitrary point within the task's > shadow call stack. > > When an offlines CPU is hotlpugged back into the kernel, this stale > state can adversely affect the newly onlined CPU. Stale KASAN shadow can > alias new stackframes and result in bogus KASAN warnings. A stale SCS SP > is effectively a memory leak, and prevents a portion of the shadow call > stack being used. Across a number of hotplug cycles the task's entire > shadow call stack can become unusable. > > We previously fixed the KASAN issue in commit: > > e1b77c92981a5222 ("sched/kasan: remove stale KASAN poison after hotplug") > > In commit: > > f1a0a376ca0c4ef1 ("sched/core: Initialize the idle task with preemption disabled") > > ... we broke both KASAN and SCS, with SCS being fixed up in commit: > > 63acd42c0d4942f7 ("sched/scs: Reset the shadow stack when idle_task_exit") > > ... but as this runs in the context of the idle task being offlines it's > potentially fragile. > > Fix both of these consistently and more robustly by resetting the SCS SP > and KASAN shadow immediately before we online a CPU. This ensures the > idle task always has a consistent state, and removes the need to do so > when initializing an idle task or when unplugging an idle task. > > I've tested this with both GCC and clang, with reelvant options enabled, > offlining and online CPUs with: > > | while true; do > | for C in /sys/devices/system/cpu/cpu*/online; do > | echo 0 > $C; > | echo 1 > $C; > | done > | done > > Link: https://lore.kernel.org/lkml/20211012083521.973587-1-woodylin@google.com/ > Link: https://lore.kernel.org/linux-arm-kernel/YY9ECKyPtDbD9q8q@qian-HP-Z2-SFF-G5-Workstation/ > Fixes: 1a0a376ca0c4ef1 ("sched/core: Initialize the idle task with preemption disabled") > Reported-by: Qian Cai > Signed-off-by: Mark Rutland Thanks for fixing this quickly, Mark. Triggering an user-after-free in user namespace but don't think it is related. I'll investigate that first since it is blocking the rest of regression testing. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel