[PATCH for 5.4 and 5.10] ACPI: PAD: fix crash in exit_round_robin()

[PATCH for 5.4 and 5.10] ACPI: PAD: fix crash in exit_round_robin()

[Nobuhiro Iwamatsu]

From: Seiji Nishikawa <snishika@redhat.com>

commit 0a2ed70a549e61c5181bad5db418d223b68ae932 upstream.

The kernel occasionally crashes in cpumask_clear_cpu(), which is called
within exit_round_robin(), because when executing clear_bit(nr, addr) with
nr set to 0xffffffff, the address calculation may cause misalignment within
the memory, leading to access to an invalid memory address.

----------
BUG: unable to handle kernel paging request at ffffffffe0740618
        ...
CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G           OE  X --------- -  - 4.18.0-425.19.2.el8_7.x86_64 #1
        ...
RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]
Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31
RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202
RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8
R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e
R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e
FS:  0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 ? acpi_pad_add+0x120/0x120 [acpi_pad]
 kthread+0x10b/0x130
 ? set_kthread_struct+0x50/0x50
 ret_from_fork+0x1f/0x40
        ...
CR2: ffffffffe0740618

crash> dis -lr ffffffffc0726923
        ...
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114
0xffffffffc0726918 <power_saving_thread+776>:	mov    %r12d,%r12d
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325
0xffffffffc072691b <power_saving_thread+779>:	mov    -0x3f8d7de0(,%r12,4),%eax
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80
0xffffffffc0726923 <power_saving_thread+787>:	lock btr %rax,0x19cf4(%rip)        # 0xffffffffc0740620 <pad_busy_cpus_bits>

crash> px tsk_in_cpu[14]
$66 = 0xffffffff

crash> px 0xffffffffc072692c+0x19cf4
$99 = 0xffffffffc0740620

crash> sym 0xffffffffc0740620
ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]

crash> px pad_busy_cpus_bits[0]
$42 = 0xfffc0
----------

To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling
cpumask_clear_cpu() in exit_round_robin(), just as it is done in
round_robin_cpu().

Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
Link: https://patch.msgid.link/20240825141352.25280-1-snishika@redhat.com
[ rjw: Subject edit, avoid updates to the same value ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://nvd.nist.gov/vuln/detail/CVE-2024-49935
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
---
 drivers/acpi/acpi_pad.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index 35de23ff50d6..3e7e28b7947e 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -128,8 +128,11 @@ static void round_robin_cpu(unsigned int tsk_index)
 static void exit_round_robin(unsigned int tsk_index)
 {
 	struct cpumask *pad_busy_cpus = to_cpumask(pad_busy_cpus_bits);
-	cpumask_clear_cpu(tsk_in_cpu[tsk_index], pad_busy_cpus);
-	tsk_in_cpu[tsk_index] = -1;
+
+	if (tsk_in_cpu[tsk_index] != -1) {
+		cpumask_clear_cpu(tsk_in_cpu[tsk_index], pad_busy_cpus);
+		tsk_in_cpu[tsk_index] = -1;
+	}
 }
 
 static unsigned int idle_pct = 5; /* percentage */
-- 
2.25.1

Re: [PATCH for 5.4 and 5.10] ACPI: PAD: fix crash in exit_round_robin()

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 0a2ed70a549e61c5181bad5db418d223b68ae932

WARNING: Author mismatch between patch and upstream commit:
Backport author: Nobuhiro Iwamatsu<nobuhiro1.iwamatsu@toshiba.co.jp>
Commit author: Seiji Nishikawa<snishika@redhat.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: 68a8e45743d6)
6.1.y | Present (different SHA1: 68a599da16eb)
5.15.y | Present (different SHA1: 92e5661b7d07)
5.10.y | Not found

Note: The patch differs from the upstream commit:
---
1:  0a2ed70a549e6 ! 1:  bc54e445630f7 ACPI: PAD: fix crash in exit_round_robin()
    @@ Metadata
      ## Commit message ##
         ACPI: PAD: fix crash in exit_round_robin()
     
    +    commit 0a2ed70a549e61c5181bad5db418d223b68ae932 upstream.
    +
         The kernel occasionally crashes in cpumask_clear_cpu(), which is called
         within exit_round_robin(), because when executing clear_bit(nr, addr) with
         nr set to 0xffffffff, the address calculation may cause misalignment within
    @@ Commit message
         Link: https://patch.msgid.link/20240825141352.25280-1-snishika@redhat.com
         [ rjw: Subject edit, avoid updates to the same value ]
         Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    +    Link: https://nvd.nist.gov/vuln/detail/CVE-2024-49935
    +    Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
     
      ## drivers/acpi/acpi_pad.c ##
    -@@ drivers/acpi/acpi_pad.c: static void exit_round_robin(unsigned int tsk_index)
    +@@ drivers/acpi/acpi_pad.c: static void round_robin_cpu(unsigned int tsk_index)
    + static void exit_round_robin(unsigned int tsk_index)
      {
      	struct cpumask *pad_busy_cpus = to_cpumask(pad_busy_cpus_bits);
    - 
     -	cpumask_clear_cpu(tsk_in_cpu[tsk_index], pad_busy_cpus);
     -	tsk_in_cpu[tsk_index] = -1;
    ++
     +	if (tsk_in_cpu[tsk_index] != -1) {
     +		cpumask_clear_cpu(tsk_in_cpu[tsk_index], pad_busy_cpus);
     +		tsk_in_cpu[tsk_index] = -1;
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.4.y        |  Success    |  Success   |
| stable/linux-5.10.y       |  Success    |  Success   |

Re: [PATCH for 5.4 and 5.10] ACPI: PAD: fix crash in exit_round_robin()

[Greg Kroah-Hartman]

On Wed, Jun 25, 2025 at 08:56:14AM +0900, Nobuhiro Iwamatsu wrote:
> From: Seiji Nishikawa <snishika@redhat.com>
> 
> commit 0a2ed70a549e61c5181bad5db418d223b68ae932 upstream.
> 
> The kernel occasionally crashes in cpumask_clear_cpu(), which is called
> within exit_round_robin(), because when executing clear_bit(nr, addr) with
> nr set to 0xffffffff, the address calculation may cause misalignment within
> the memory, leading to access to an invalid memory address.
> 
> ----------
> BUG: unable to handle kernel paging request at ffffffffe0740618
>         ...
> CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G           OE  X --------- -  - 4.18.0-425.19.2.el8_7.x86_64 #1
>         ...
> RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]
> Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31
> RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202
> RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
> RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8
> R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e
> R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e
> FS:  0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> PKRU: 55555554
> Call Trace:
>  ? acpi_pad_add+0x120/0x120 [acpi_pad]
>  kthread+0x10b/0x130
>  ? set_kthread_struct+0x50/0x50
>  ret_from_fork+0x1f/0x40
>         ...
> CR2: ffffffffe0740618
> 
> crash> dis -lr ffffffffc0726923
>         ...
> /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114
> 0xffffffffc0726918 <power_saving_thread+776>:	mov    %r12d,%r12d
> /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325
> 0xffffffffc072691b <power_saving_thread+779>:	mov    -0x3f8d7de0(,%r12,4),%eax
> /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80
> 0xffffffffc0726923 <power_saving_thread+787>:	lock btr %rax,0x19cf4(%rip)        # 0xffffffffc0740620 <pad_busy_cpus_bits>
> 
> crash> px tsk_in_cpu[14]
> $66 = 0xffffffff
> 
> crash> px 0xffffffffc072692c+0x19cf4
> $99 = 0xffffffffc0740620
> 
> crash> sym 0xffffffffc0740620
> ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]
> 
> crash> px pad_busy_cpus_bits[0]
> $42 = 0xfffc0
> ----------
> 
> To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling
> cpumask_clear_cpu() in exit_round_robin(), just as it is done in
> round_robin_cpu().
> 
> Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
> Link: https://patch.msgid.link/20240825141352.25280-1-snishika@redhat.com
> [ rjw: Subject edit, avoid updates to the same value ]
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Link: https://nvd.nist.gov/vuln/detail/CVE-2024-49935

Why did you add a nist.gov link here?

NIST is know to "enhance" cve.org reports in ways that are flat out
wrong.  Never trust them, only rely on the original cve.org report
please, as that is under our control.

Also NIST totally ignores numerous parts of the cve.org report that we
provide, making this type of link contain less information overall than
the original report.

And finally, no need to add links like this to backports.  If we were to
do that everywhere, it would be a total mess given our rate of 13 CVEs a
day we are currently running at.

thanks,

greg k-h

RE: [PATCH for 5.4 and 5.10] ACPI: PAD: fix crash in exit_round_robin()

[nobuhiro1.iwamatsu]

Hi Greg,

> -----Original Message-----
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Sent: Thursday, July 10, 2025 10:36 PM
> To: iwamatsu nobuhiro(岩松 信洋 □ＤＩＴＣ○ＣＰＴ)
> <nobuhiro1.iwamatsu@toshiba.co.jp>
> Cc: stable@vger.kernel.org; Sasha Levin <sashal@kernel.org>; Seiji Nishikawa
> <snishika@redhat.com>; Rafael J . Wysocki <rafael.j.wysocki@intel.com>
> Subject: Re: [PATCH for 5.4 and 5.10] ACPI: PAD: fix crash in
> exit_round_robin()
> 
> On Wed, Jun 25, 2025 at 08:56:14AM +0900, Nobuhiro Iwamatsu wrote:
> > From: Seiji Nishikawa <snishika@redhat.com>
> >
> > commit 0a2ed70a549e61c5181bad5db418d223b68ae932 upstream.
> >
> > The kernel occasionally crashes in cpumask_clear_cpu(), which is
> > called within exit_round_robin(), because when executing clear_bit(nr,
> > addr) with nr set to 0xffffffff, the address calculation may cause
> > misalignment within the memory, leading to access to an invalid memory
> address.
> >
> > ----------
> > BUG: unable to handle kernel paging request at ffffffffe0740618
> >         ...
> > CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G
> OE  X --------- -  - 4.18.0-425.19.2.el8_7.x86_64 #1
> >         ...
> > RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]
> > Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05
> > 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48
> > 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31
> > RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202
> > RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000
> > RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
> > RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8
> > R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e
> > R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e
> > FS:  0000000000000000(0000) GS:ff46297a800c0000(0000)
> > knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > PKRU: 55555554
> > Call Trace:
> >  ? acpi_pad_add+0x120/0x120 [acpi_pad]
> >  kthread+0x10b/0x130
> >  ? set_kthread_struct+0x50/0x50
> >  ret_from_fork+0x1f/0x40
> >         ...
> > CR2: ffffffffe0740618
> >
> > crash> dis -lr ffffffffc0726923
> >         ...
> >
> /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_
> 64/./include/linux/cpumask.h: 114
> > 0xffffffffc0726918 <power_saving_thread+776>:
> 	mov    %r12d,%r12d
> >
> /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_
> 64/./include/linux/cpumask.h: 325
> > 0xffffffffc072691b <power_saving_thread+779>:	mov
> -0x3f8d7de0(,%r12,4),%eax
> >
> /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_
> 64/./arch/x86/include/asm/bitops.h: 80
> > 0xffffffffc0726923 <power_saving_thread+787>:	lock
> btr %rax,0x19cf4(%rip)        # 0xffffffffc0740620 <pad_busy_cpus_bits>
> >
> > crash> px tsk_in_cpu[14]
> > $66 = 0xffffffff
> >
> > crash> px 0xffffffffc072692c+0x19cf4
> > $99 = 0xffffffffc0740620
> >
> > crash> sym 0xffffffffc0740620
> > ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]
> >
> > crash> px pad_busy_cpus_bits[0]
> > $42 = 0xfffc0
> > ----------
> >
> > To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling
> > cpumask_clear_cpu() in exit_round_robin(), just as it is done in
> > round_robin_cpu().
> >
> > Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
> > Link:
> > https://patch.msgid.link/20240825141352.25280-1-snishika@redhat.com
> > [ rjw: Subject edit, avoid updates to the same value ]
> > Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> > Link: https://nvd.nist.gov/vuln/detail/CVE-2024-49935
> 
> Why did you add a nist.gov link here?

I have added a link tag to add backport CVE infomation.

> 
> NIST is know to "enhance" cve.org reports in ways that are flat out wrong.
> Never trust them, only rely on the original cve.org report please, as that is under
> our control.
> 
> Also NIST totally ignores numerous parts of the cve.org report that we provide,
> making this type of link contain less information overall than the original report.
> 
> And finally, no need to add links like this to backports.  If we were to do that
> everywhere, it would be a total mess given our rate of 13 CVEs a day we are
> currently running at.

Thanks for the explanation. I understand it.
I will resend the patch with the link tag removed. I will also not to add unnecessary tags
form next patch.

> 
> thanks,
> 
> greg k-h

Best regards,
  Nobuhiro