Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1493384
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.12 002/119] x86/mm: Disable preemption during CR3 read+write |
| Date | 2016-09-29 13:00 +0200 |
| Message-ID | <smHej-33A-45@gated-at.bofh.it> (permalink) |
| References | <smGLf-2Ok-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5cf0791da5c162ebc14b01eb01631cfa7ed4fa6e upstream.
There's a subtle preemption race on UP kernels:
Usually current->mm (and therefore mm->pgd) stays the same during the
lifetime of a task so it does not matter if a task gets preempted during
the read and write of the CR3.
But then, there is this scenario on x86-UP:
TaskA is in do_exit() and exit_mm() sets current->mm = NULL followed by:
-> mmput()
-> exit_mmap()
-> tlb_finish_mmu()
-> tlb_flush_mmu()
-> tlb_flush_mmu_tlbonly()
-> tlb_flush()
-> flush_tlb_mm_range()
-> __flush_tlb_up()
-> __flush_tlb()
-> __native_flush_tlb()
At this point current->mm is NULL but current->active_mm still points to
the "old" mm.
Let's preempt taskA _after_ native_read_cr3() by taskB. TaskB has its
own mm so CR3 has changed.
Now preempt back to taskA. TaskA has no ->mm set so it borrows taskB's
mm and so CR3 remains unchanged. Once taskA gets active it continues
where it was interrupted and that means it writes its old CR3 value
back. Everything is fine because userland won't need its memory
anymore.
Now the fun part:
Let's preempt taskA one more time and get back to taskB. This
time switch_mm() won't do a thing because oldmm (->active_mm)
is the same as mm (as per context_switch()). So we remain
with a bad CR3 / PGD and return to userland.
The next thing that happens is handle_mm_fault() with an address for
the execution of its code in userland. handle_mm_fault() realizes that
it has a PTE with proper rights so it returns doing nothing. But the
CPU looks at the wrong PGD and insists that something is wrong and
faults again. And again. And one more time…
This pagefault circle continues until the scheduler gets tired of it and
puts another task on the CPU. It gets little difficult if the task is a
RT task with a high priority. The system will either freeze or it gets
fixed by the software watchdog thread which usually runs at RT-max prio.
But waiting for the watchdog will increase the latency of the RT task
which is no good.
Fix this by disabling preemption across the critical code section.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-mm@kvack.org
Link: http://lkml.kernel.org/r/1470404259-26290-1-git-send-email-bigeasy@linutronix.de
[ Prettified the changelog. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/x86/include/asm/tlbflush.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 04905bfc508b..5e4b0cc54e43 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -17,7 +17,14 @@
static inline void __native_flush_tlb(void)
{
+ /*
+ * If current->mm == NULL then we borrow a mm which may change during a
+ * task switch and therefore we must not be preempted while we write CR3
+ * back:
+ */
+ preempt_disable();
native_write_cr3(native_read_cr3());
+ preempt_enable();
}
static inline void __native_flush_tlb_global_irq_disabled(void)
--
2.10.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 001/119] MIPS: KVM: Check for pfn noslot case Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 057/119] drm: Reject page_flip for !DRIVER_MODESET Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 012/119] USB: validate wMaxPacketValue entries in endpoint descriptors Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 013/119] usb: xhci: Fix panic if disconnect Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 010/119] usb: dwc3: gadget: increment request->actual once Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 055/119] ipv6: release dst in ping_v6_sendmsg Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 014/119] USB: serial: fix memleak in driver-registration error path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 015/119] USB: serial: option: add D-Link DWM-156/A3 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 111/119] metag: copy_from_user() should zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 114/119] mn10300: copy_from_user() should zero on access_ok() failure... Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 089/119] arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 098/119] score: fix __get_user/get_user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 110/119] alpha: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 101/119] asm-generic: make get_user() clear the destination on errors Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 112/119] parisc: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 102/119] frv: fix clear_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 096/119] m32r: fix __get_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 105/119] score: fix copy_from_user() and friends Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 106/119] sh: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 109/119] asm-generic: make copy_from_user() zero the destination properly Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 100/119] ARC: uaccess: get_user to zero out dest in cause of fault Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 093/119] microblaze: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 088/119] ARM: OMAP3: hwmod data: Add sysc information for DSI Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 091/119] microblaze: fix __get_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 062/119] x86/apic: Do not init irq remapping if ioapic is disabled Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 113/119] openrisc: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 115/119] sparc32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 095/119] mn10300: failing __get_user() and get_user() should zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 097/119] sh64: failing __get_user() should zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 118/119] avr32: fix 'undefined reference to `___copy_from_user' Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 090/119] crypto: cryptd - initialize child shash_desc on import Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 085/119] USB: serial: simple: add support for another Infineon flashloader Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 099/119] s390: get_user() should zero on failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 117/119] ia64: copy_from_user() should zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 084/119] iio: accel: kxsd9: Fix scaling bug Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 083/119] iio: accel: kxsd9: Fix raw read return Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 116/119] ppc32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 103/119] cris: buggered copy_from_user/copy_to_user/clear_user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 092/119] avr32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 104/119] blackfin: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 108/119] mips: copy_from_user() must zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 087/119] USB: change bInterval default to 10 ms Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 107/119] hexagon: fix strncpy_from_user() error return Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 094/119] fix minor infoleak in get_user_ex() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 119/119] openrisc: fix the fix of copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 086/119] usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 033/119] USB: serial: mos7840: fix non-atomic allocation in write path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 075/119] ipvs: count pre-established TCP states as active Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 043/119] fix d_walk()/non-delayed __d_free() race Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 044/119] ext4: avoid modifying checksum fields directly during checksum verification Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 079/119] NFSv4.x: Fix a refcount leak in nfs_callback_up_net Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 048/119] net/irda: handle iriap_register_lsap() allocation failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 082/119] kvm-arm: Unmap shadow pagetables properly Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 051/119] tcp: properly scale window in tcp_v[46]_reqsk_send_ack() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 039/119] ALSA: oxygen: Fix logical-not-parentheses warning Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 045/119] timers: Use proper base migration in add_timer_on() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 073/119] mISDN: Fixing missing validation in base_sock_bind() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 069/119] hwrng: exynos - Disable runtime PM on probe failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 071/119] HID: add usb device id for Apple Magic Keyboard Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 040/119] stb6100: fix buffer length check in stb6100_write_reg_range() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 074/119] net: disable fragment reassembly if high_thresh is set to zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 067/119] scsi: fix upper bounds check of sense key in scsi_sense_key_string() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 050/119] net/mlx5: Added missing check of msg length in verifying its signature Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 080/119] dm flakey: fix reads to be issued if drop_writes configured Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 070/119] Input: ili210x - fix permissions on "calibrate" attribute Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 063/119] ALSA: rawmidi: Fix possible deadlock with virmidi registration Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 072/119] mISDN: Support DR6 indication in mISDNipac driver Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 037/119] be2iscsi: Fix bogus WARN_ON length check Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 077/119] clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 038/119] HID: hid-input: Add parentheses to quell gcc warning Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 042/119] s390/sclp_ctl: fix potential information leak with /dev/sclp Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 064/119] ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 035/119] ACPI / sysfs: fix error code in get_status() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 041/119] ext4: validate that metadata blocks do not overlap superblock Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 046/119] ext4: use __GFP_NOFAIL in ext4_free_blocks() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 078/119] powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 047/119] Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel" Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 065/119] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 081/119] x86/paravirt: Do not trace _paravirt_ident_*() functions Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 076/119] x86/mm/pat, /dev/mem: Remove superfluous error message Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 068/119] cpufreq: Fix GOV_LIMITS handling for the userspace governor Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 066/119] ALSA: timer: fix NULL pointer dereference on memory allocation failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 049/119] tcp: fix use after free in tcp_xmit_retransmit_queue() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 026/119] gpio: Fix OF build problem on UM Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 027/119] fs/seq_file: fix out-of-bounds read Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 024/119] cdc-acm: fix wrong pipe type on rx interrupt xfers Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 036/119] Revert "can: fix handling of unmodifiable configuration options fix" Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 021/119] s390/dasd: fix hanging device after clear subchannel Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 028/119] Input: i8042 - break load dependency between atkbd/psmouse and i8042 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 029/119] Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 031/119] USB: fix typo in wMaxPacketSize validation Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 019/119] xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices. Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 020/119] EDAC: Increment correct counter in edac_inc_ue_error() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 023/119] aacraid: Check size values after double-fetch from user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 034/119] staging: comedi: daqboard2000: bug fix board type matching code Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 002/119] x86/mm: Disable preemption during CR3 read+write Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 022/119] mac80211: fix purging multicast PS buffer queue Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 005/119] PCI: Support PCIe devices with short cfg_size Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 016/119] USB: serial: option: add support for Telit LE920A4 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 004/119] parisc: Fix order of EREFUSED define in errno.h Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 018/119] USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 030/119] crypto: nx - off by one bug in nx_of_update_msc() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 025/119] megaraid_sas: Fix probing cards without io port Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 006/119] PCI: Add Netronome vendor and device IDs Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 032/119] USB: serial: mos7720: fix non-atomic allocation in write path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Guenter Roeck <linux@roeck-us.net> - 2016-09-29 16:30 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-10-03 13:00 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-09-29 19:20 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Mike Galbraith <umgwanakikbuti@gmail.com> - 2016-09-30 07:30 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-09-30 08:50 +0200
csiph-web