[PATCH 1/1] iommu/amd: Fix "execute NX-protected page" when running CPU hotplug

[PATCH 1/1] iommu/amd: Fix "execute NX-protected page" when running CPU hotplug

[Adrian Huang]

From: Adrian Huang <ahuang12@lenovo.com>

When running the following command (cpu hotplug test case of LTP),
the "execute NX-protected page" exception is triggered.

  # /opt/ltp/testcases/bin/cpuhotplug02.sh -c 1 -l 1

Here is the call trace:

  process 14301 (cpuhotplug_do_s) no longer affine to cpu1
  smpboot: CPU 1 is now offline
  smpboot: Booting Node 0 Processor 1 APIC 0x2
  LVT offset 0 assigned for vector 0x400
  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
  BUG: unable to handle page fault for address: ffffffffbb559170
  #PF: supervisor instruction fetch in kernel mode
  #PF: error_code(0x0011) - permissions violation
  PGD 1ae25067 P4D 1ae25067 PUD 1ae26063 PMD 134abd063 PTE 80000000
  Oops: Oops: 0011 [#1] PREEMPT SMP NOPTI
  CPU: 1 PID: 24 Comm: cpuhp/1 Kdump: loaded Not tainted 6.10.0-rc3
  Hardware name: Lenovo ThinkSystem SR665 MB/7D2WRCZ000, BIOS D8E121K-2.20 08/12/2021
  RIP: 0010:amd_iommu_enable_faulting+0x0/0x10
  Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
   cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
  RSP: 0018:ffffb4e243fafe48 EFLAGS: 00010202
  RAX: 00000000000003c0 RBX: ffff90f4baea0820 RCX: 0000000000000000
  RDX: 00000000000000ec RSI: 00000000000000c0 RDI: 0000000000000001
  RBP: 0000000000000001 R08: ffff90f4baea0848 R09: ffff90f184a90d00
  R10: ffff90f184a90ce0 R11: ffff90f1834ebaf8 R12: 00000000000000c0
  R13: ffffffffbb559170 R14: ffffffffbaa4bd00 R15: ffff90f4baea0848
  FS:  0000000000000000(0000) GS:ffff90f4bae80000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffffffffbb559170 CR3: 000000001ae20000 CR4: 0000000000350ef0
  Call Trace:
   <TASK>
   ? __die+0x20/0x70
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? page_fault_oops+0x75/0x170
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? exc_page_fault+0xaa/0x140
   ? asm_exc_page_fault+0x22/0x30
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   cpuhp_invoke_callback+0x2cc/0x470
   ? __pfx_blk_mq_hctx_notify_online+0x10/0x10
   ? __pfx_smpboot_thread_fn+0x10/0x10
   cpuhp_thread_fun+0x8b/0x140
   smpboot_thread_fn+0xd9/0x1d0
   kthread+0xcf/0x100
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x30/0x50
   ? __pfx_kthread+0x10/0x10
   ret_from_fork_asm+0x1a/0x30
   </TASK>

The address '0xffffffffbb559170' is the function address of
'amd_iommu_enable_faulting()'. However, this function is declared with
'__init' keyword and will be freed in free_initmem().

Fix the issue by removing '__init' keyword since this function is still
needed for the up-and-running kernel.

Fixes: d74169ceb0d2 ("iommu/vt-d: Allocate DMAR fault interrupts locally")
Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
---
 drivers/iommu/amd/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 27e293727095..161248067776 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -3362,7 +3362,7 @@ int amd_iommu_reenable(int mode)
 	return 0;
 }
 
-int __init amd_iommu_enable_faulting(unsigned int cpu)
+int amd_iommu_enable_faulting(unsigned int cpu)
 {
 	/* We enable MSI later when PCI is initialized */
 	return 0;
-- 
2.25.1

Re: [PATCH 1/1] iommu/amd: Fix "execute NX-protected page" when running CPU hotplug

[Vasant Hegde]

Hi Adrian,

On 6/11/2024 9:24 PM, Adrian Huang wrote:
> From: Adrian Huang <ahuang12@lenovo.com>
> 
> When running the following command (cpu hotplug test case of LTP),
> the "execute NX-protected page" exception is triggered.


Thanks for the detailed report and fix. This issue has been discussed and we
already have similar patch [1] from Dimitri.


[1] https://lore.kernel.org/linux-iommu/ZljHE%2FR4KLzGU6vx@hpe.com/

-Vasant




> 
>   # /opt/ltp/testcases/bin/cpuhotplug02.sh -c 1 -l 1
> 
> Here is the call trace:
> 
>   process 14301 (cpuhotplug_do_s) no longer affine to cpu1
>   smpboot: CPU 1 is now offline
>   smpboot: Booting Node 0 Processor 1 APIC 0x2
>   LVT offset 0 assigned for vector 0x400
>   kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
>   BUG: unable to handle page fault for address: ffffffffbb559170
>   #PF: supervisor instruction fetch in kernel mode
>   #PF: error_code(0x0011) - permissions violation
>   PGD 1ae25067 P4D 1ae25067 PUD 1ae26063 PMD 134abd063 PTE 80000000
>   Oops: Oops: 0011 [#1] PREEMPT SMP NOPTI
>   CPU: 1 PID: 24 Comm: cpuhp/1 Kdump: loaded Not tainted 6.10.0-rc3
>   Hardware name: Lenovo ThinkSystem SR665 MB/7D2WRCZ000, BIOS D8E121K-2.20 08/12/2021
>   RIP: 0010:amd_iommu_enable_faulting+0x0/0x10
>   Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
>    cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
>   RSP: 0018:ffffb4e243fafe48 EFLAGS: 00010202
>   RAX: 00000000000003c0 RBX: ffff90f4baea0820 RCX: 0000000000000000
>   RDX: 00000000000000ec RSI: 00000000000000c0 RDI: 0000000000000001
>   RBP: 0000000000000001 R08: ffff90f4baea0848 R09: ffff90f184a90d00
>   R10: ffff90f184a90ce0 R11: ffff90f1834ebaf8 R12: 00000000000000c0
>   R13: ffffffffbb559170 R14: ffffffffbaa4bd00 R15: ffff90f4baea0848
>   FS:  0000000000000000(0000) GS:ffff90f4bae80000(0000) knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: ffffffffbb559170 CR3: 000000001ae20000 CR4: 0000000000350ef0
>   Call Trace:
>    <TASK>
>    ? __die+0x20/0x70
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? page_fault_oops+0x75/0x170
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? exc_page_fault+0xaa/0x140
>    ? asm_exc_page_fault+0x22/0x30
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    cpuhp_invoke_callback+0x2cc/0x470
>    ? __pfx_blk_mq_hctx_notify_online+0x10/0x10
>    ? __pfx_smpboot_thread_fn+0x10/0x10
>    cpuhp_thread_fun+0x8b/0x140
>    smpboot_thread_fn+0xd9/0x1d0
>    kthread+0xcf/0x100
>    ? __pfx_kthread+0x10/0x10
>    ret_from_fork+0x30/0x50
>    ? __pfx_kthread+0x10/0x10
>    ret_from_fork_asm+0x1a/0x30
>    </TASK>
> 
> The address '0xffffffffbb559170' is the function address of
> 'amd_iommu_enable_faulting()'. However, this function is declared with
> '__init' keyword and will be freed in free_initmem().
> 
> Fix the issue by removing '__init' keyword since this function is still
> needed for the up-and-running kernel.
> 
> Fixes: d74169ceb0d2 ("iommu/vt-d: Allocate DMAR fault interrupts locally")
> Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
> ---
>  drivers/iommu/amd/init.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index 27e293727095..161248067776 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -3362,7 +3362,7 @@ int amd_iommu_reenable(int mode)
>  	return 0;
>  }
>  
> -int __init amd_iommu_enable_faulting(unsigned int cpu)
> +int amd_iommu_enable_faulting(unsigned int cpu)
>  {
>  	/* We enable MSI later when PCI is initialized */
>  	return 0;