From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757040AbcCRKSB (ORCPT ); Fri, 18 Mar 2016 06:18:01 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59631 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752924AbcCRKRw (ORCPT ); Fri, 18 Mar 2016 06:17:52 -0400 Date: Fri, 18 Mar 2016 10:17:49 +0000 From: "Richard W.M. Jones" To: Thomas Gleixner Cc: Josh Boyer , x86 , "Linux-Kernel@Vger. Kernel. Org" , Peter Zijlstra Subject: Re: [PATCH] x86/tsc: Prevent NULL pointer deref in calibrate_delay_is_known() Message-ID: <20160318101749.GL1681@redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-12-10) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Mar 18, 2016 at 08:48:06AM +0100, Thomas Gleixner wrote: > Subject: x86/tsc: Prevent NULL pointer deref in calibrate_delay_is_known() > From: Thomas Gleixner > Date: Fri, 18 Mar 2016 08:35:29 +0100 > > The topology_core_cpumask is used to find a neighbour cpu in > calibrate_delay_is_known(). It might not be allocated at the first invocation > of that function on the boot cpu, when CONFIG_CPUMASK_OFFSTACK is set. > > The mask is allocated later in native_smp_prepare_cpus. As a consequence the > underlying find_next_bit() call dereferences a NULL pointer. > > Add a proper check to prevent this. > > Reported-by: Richard W.M. Jones > Fixes: c25323c07345 "x86/tsc: Use topology functions" > Signed-off-by: Thomas Gleixner > Cc: Josh Boyer I have tested the current upstream kernel (9dffdb38d) and was able to reproduce the bug. I then added this patch on top and it fixes the problem for me. Therefore: Tested-by: Richard W.M. Jones Thanks, Rich. > --- > arch/x86/kernel/tsc.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > --- a/arch/x86/kernel/tsc.c > +++ b/arch/x86/kernel/tsc.c > @@ -1306,11 +1306,15 @@ void __init tsc_init(void) > unsigned long calibrate_delay_is_known(void) > { > int sibling, cpu = smp_processor_id(); > + struct cpumask *mask = topology_core_cpumask(cpu); > > if (!tsc_disabled && !cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC)) > return 0; > > - sibling = cpumask_any_but(topology_core_cpumask(cpu), cpu); > + if (!mask) > + return 0; > + > + sibling = cpumask_any_but(mask, cpu); > if (sibling < nr_cpu_ids) > return cpu_data(sibling).loops_per_jiffy; > return 0; -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html