From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752558AbdAYTPA (ORCPT ); Wed, 25 Jan 2017 14:15:00 -0500 Received: from mail-ve1eur01on0128.outbound.protection.outlook.com ([104.47.1.128]:41000 "EHLO EUR01-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752346AbdAYTO6 (ORCPT ); Wed, 25 Jan 2017 14:14:58 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; Subject: Re: x86/microcode: use-after-free after cpu offline/online To: Borislav Petkov References: <3e4b6f03-384d-411e-5243-9d3b0595d5cb@virtuozzo.com> <20170125172321.fpy6cswq3ibqvfgo@pd.tnic> CC: Thomas Gleixner , LKML , "H. Peter Anvin" , Ingo Molnar From: Andrey Ryabinin Message-ID: <16165aad-5990-51f9-4dc7-c4b68597a4d5@virtuozzo.com> Date: Wed, 25 Jan 2017 22:14:50 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <20170125172321.fpy6cswq3ibqvfgo@pd.tnic> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [84.47.128.244] X-ClientProxiedBy: HE1PR02CA0063.eurprd02.prod.outlook.com (10.163.170.31) To VI1PR0801MB2062.eurprd08.prod.outlook.com (10.173.74.147) X-MS-Office365-Filtering-Correlation-Id: 04b8c634-6125-4166-cc96-08d445567205 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:VI1PR0801MB2062; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2062;3:PPlS+xn7cjrPsZKii6xDQAG0aclg1NQy9SXd+20Orqpjlh1xZAJuw4SmkP9ZcKIC0FEnCft8x00XfuV/YRGk32z3kIAQKeJI1tfTI/E839r+uB2mPijZqYCBEaqIqQVltjo/58L5zfpF6uhEbnSt9F03WiEx15t5XByq6V0xITlT56fnsza7o94DBkTeEyEc0rinQK51aNWkvtuRXzMt3+MVn8fX8KjaxMpVnOBx5gNN+TaKRS461FWroynLSxMS0W7RpZISkUtNUsSq3QkkfA== X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2062;25:i4BxYfpP1JFY1xy+wbBuQ+7QY9bkF//N6EsTqxd279cdy2k9SWOQjZkt42ZRO2HPIe/SFR4QfLDu225zB+gvxjhtn1mob/JFmqjFgKCgs994VnSUkE5bXHWcSn3jjPz9FaJ1MPkTHHmZFqkUe9nzP8EsXJYqlgTWeGWBdXpHEF3+T30hPv79/VBCvqiHmP+OdhhGdKwmow545KsBGZfjeVsLW3OpzjUt1kmhw6ofMsXKNkCCVsJ3Tc54pT5E7HEKnZboLSxfKBfbemoP36+fqxiLxVanfD2fhi5vjMCNKFfP/JRoJvnmoZbpSng0vDGv0wWAKcWLT5DAL9OFPuHDKfsPC9fMA1PYz9f/Kd3sIl94I8tFpWDMDm3M8vsyX4tfy1aIiv6lSuUVqMFo6yRfnvndRBaweEaeD4gNdV9TbR+IoSB9TMhF9ZU4uGa9Wpz6Fq6m+kgh3n8RSrsa/wSZMDS4UPtFA7lNZIFWZmoSYj2rc5PlOkUHeKPQUDA6K/tFVDhSERVa/DkiwUAFqYUcBI/n5YYtqe9THLuhKRtrSiogG2mTyFX1mexQIRfoJP50QCaeypM3BJNdmAZwa/jaldBBTQcxXRkYJIfwYz2Zt4HQZ87CYk0Nj5H6mT8UAXaMbjaeEjnAcO28M6PQ8jbGK4BWoSvSGN/5hyMf3+Gj2+FX0KX6eUO08hzUjErMU6mGkmnR/4aSoyVJCzJUawoYAu1Qkp3j+EQykCl2euIahSkCRTSbuJzcgs2PqzyZrp4fuCASyEq14usbRjS60QXdOQ== X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2062;31:+G6P4ahDCSVzYAni1fhQj7W7OSpkToRe+9ocGcr1Iu5FJzafAZnjWuPCzh94mVWEm0s0gK3DiC2hH+E/MYmuVCoIvibv50pg5sk19Y06dnKCWlvRxrdqu3v0ZK7MGOgvQltaFOTQ9hOBOMVJBk6BLtMMEnG0Pb0PZ2KDc7Jn0g//9cPNy6QR20HCFEJVvTPvdCblSLR7leeVJyWWGn+CgMGQhDKGNM0POD3Saw/0F/p5iCb24tYSJ9mLSzdCTWlIWKwBsmfoSVS7r/Xf+H0WhaIFAlcYo1fu0NytOtM6Ctk=;20:nziu+OH19TsG2CoCQ9PuhcLq3q4QWOmy6o7oEy8/tTS5qqPrYpw3zcXW3HfVKl4SucT1NBxgFTj0XyIeonnt03tQYShCMHIO1Vlebpr+yTsxAq+oymXnkH9ThHgfHtP5YHCSEN6ZpEx/vSQlxICNtm29+9IkAEINUA39o85svemnktT9mAN3+Ni5mp0ZhO2QLn3IjRF18lHOTYQbyHgIBWrhJY/0G8Gl79LUBDe9lOiDvW1UXmxPLRc9OyuhUewI X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(209352067349851); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(6072148);SRVR:VI1PR0801MB2062;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB2062; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2062;4:vArBp12awy9QQiyuWwXKhmis5MR38gTdkoR/0Dh/N/JM+V2qjNquYVfylcEHcmvydTlDFuHrtfbVOPXbWpBIo5DDOjdD9OYSiG53vl6lg2IsexeqnelHBeagZTbRGlwSwMQ6QNXlLqnk8vTNvq+vWU0QdtMt5k+13S9jQvC1LbGH5a2on0m43bsOluOqyJUz3TjmPO49Q7oFbFAwh3o69f839zbb4E4A9hscbpjyD2IVvabHCu2ownl5WwxYWXHpJ9PU9sEsGOJIrhz0OB2LHLAX2v/fJHoMFBfPo6bxzpJnAz3aFwUjs5ozehm9XrrJQA7/uleGifae9wiRDgdCXxoycQsaDBtlzh6qlCbk9rImhAZEiu4xPuOqr51iIYmKG32S6r3H9X6Mm72ovxVNF1RczyeeZxSA2JK4SV0TpmaEqDF0aaQWQbWrNS6C2tttSiW8kEhNijh7jVBp1+uDRVaNpN5IqHDfxxMMW/r+2NoZxo20YDbLKrahu6oLpbglUceBp+R93ZFl6WlHDoUKLuJe6EzlUAnfO3Id9B5v07a/7uaHhxHnU+ZQrXHOGfe/9/mzUrCK2hMM/gNBVdoAhY5F6kPZfMvPi55Rq/qUhSan2Vhj9EkfT77gpFHbpXkh X-Forefront-PRVS: 01986AE76B X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(39410400002)(39450400003)(39830400002)(24454002)(377454003)(189002)(199003)(110136003)(33646002)(4001350100001)(81156014)(6116002)(6916009)(81166006)(23676002)(97736004)(189998001)(6666003)(36756003)(230700001)(8676002)(83506001)(230783001)(5660300001)(54906002)(2950100002)(65826007)(4326007)(25786008)(31696002)(6486002)(106356001)(90366009)(65956001)(77096006)(3846002)(105586002)(86362001)(38730400001)(65806001)(305945005)(53936002)(64126003)(2906002)(229853002)(92566002)(50986999)(47776003)(76176999)(31686004)(68736007)(54356999)(42186005)(50466002)(7736002)(101416001)(66066001);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB2062;H:[10.52.82.3];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtWSTFQUjA4MDFNQjIwNjI7MjM6YzNKeTBKMmZhL3ZnenZqQnc0YjlaZVhX?= =?utf-8?B?L1FmRnQ1eHVrWXlNakpISHJXQmFXWXdQRVlpOGp3NmxOTDNadEFLeXQyQURu?= =?utf-8?B?OWhwQ2JLcUtkMHFzcFZCa3hBUFlRTXVVV3Z5L0dLb2JwVDBTSWF1ZDY2cURn?= =?utf-8?B?R2F0S2tHT3lyYTAzazZzbU12V3FWWGxNZzBWYUtYMFk3Q0J4Y2FUQnEwTWY4?= =?utf-8?B?RGs3Z0dYdFhuenY0NHd2c0h6SjZDVmlNTVduSlR4Q1ZCOForMDZxeEthaXdL?= =?utf-8?B?VWVaMFU2Zzg3RXVjL1F0OUpBSFA5YmlPc0FZcVRGeVF1UzFoSVZaQ242bnJp?= =?utf-8?B?UVJCTUdrekJtWmZNbk41M3pvdk9WQUt1eHJpQWRGSUFUK2EvRUtTRVdnWmxS?= =?utf-8?B?eXg5bHVqQ0FJeVdadTJSalAyVnFCK3JZUXoweTFHMWwwSGR2Zkt3dTFxUHFF?= =?utf-8?B?bDhVTUw0NTIvN0doejlid2FvMTJNZENvQWhMbi9peS9HOVhwMzdGYWJOUWFy?= =?utf-8?B?ZGM2eFNNSHY2OUdZU0FqbDJBZnJodjM2Mi9vOHdCRnluYzBEOUJXTXcwQ0xG?= =?utf-8?B?UDg0ajhCUnE4Qm5HYVo1NkVRcTFCL1ZNdUVUdlNWWUw2VUFRaTEvU3Z3L3NP?= =?utf-8?B?cmdWRmJVMVV5L1dsdWp3bVpoR0Rvd0MvSWpNNTd3K3M0SWJXNFZ4T0d3SU1j?= =?utf-8?B?NjdONFoyOVBsYjJFejZrN0ZBUUJFRFRBWmNRdThqYklMMzBOQkJGV2NsS24z?= =?utf-8?B?b0NEdFEwN1V4NnZuaVVvUm5BQUJxRkk3dUFPcVF6MjZJQjlGN0t0RHVxM3RH?= =?utf-8?B?UllYYWtDSnk0QVR5N2lMODVqSHRvclVlME9YeURzZG5aV0htME5Yd2FKVzBU?= =?utf-8?B?Zk1ZT3JSK2RkK3pZY2hTcDVVSm5YWXF2NEJMdm1wOExXUm1JRUtWL2hOd0w1?= =?utf-8?B?OGtmL244ZUdHZGZKSWN6dTdsY0FGNU1iWUdoczA0L0Jmd3JJMDUwVFh4eEhU?= =?utf-8?B?cEhHeStXTU9wMjhiNUl5RHJEZ0lpNjhkQUFsWnFDeEQzUGUyVGRRN0hDRkxi?= =?utf-8?B?SFlHempYWUpuZDh3Y0VBZjRxVDFDZUh2aUhVTkRPZjhsTzdVc3d2Ukp2M1hL?= =?utf-8?B?LzdtZDJYSnZLRmoxaVlZL1hpUU5MRjJpSU11Nzl5TTVMZW5mVjNId1cwbUZ6?= =?utf-8?B?UHo3TzdXTVBDTzBjaFU4Z3FaZnJ0S2FRZnRCRExZM050a1RkMzRSeStIQ0Q1?= =?utf-8?B?OGhLeVBuNlBXUlM2ejg2OExaNHgwTzBqVEZIdC9vblRKdXZpMGtGZXROcGtJ?= =?utf-8?B?U3A5Vmxjb3RZbUFjMlQ3VHU5TW1ucFR0eVZ0Y1pXVU5UdEYwRk5IYlBhTk41?= =?utf-8?B?UWczUVpQZE1PcnUrbzM2eGdxVVp2Y1VzdjhCQmx3cG1EZExKSjg4SHhEYzNM?= =?utf-8?B?MUZXZVpaVUxldEo4bzdZcW5ialdlbW9CajBYOEtBbGRFaHhvR05XWWdDeHYz?= =?utf-8?B?eEtMekZscUFPUzVKQVV5SWpsNWdJT2NqQUFWajRPdkJkenhiRDdBdmJ0cW1u?= =?utf-8?B?OFI0UmNZc1JZQ0tNU2Fub0EwVjRKcER5aG5wRGd5bDQ2OHAvSUV6bDdPRmEw?= =?utf-8?B?SkE5R3V2SDFUTldzeGRTRGlyVmdrNCtDK0pGVDBxdjVVZUsrbk9BWjRiNDFp?= =?utf-8?B?M1JXQVRVam1JSlRTbHRnVXpQNmR5K0JMejIzL1h6SVo2enF6cDR3UXlTMW9p?= =?utf-8?B?T1dZbExHeW54NXlaRnVFaGtQQnBYSklKVG0wcUQybkpDVEMyTWpmZFhvVHBq?= =?utf-8?B?UGdkdjBTSlhsdGYvK0NTNnJKQ2FoTkdZeDgxcXc0SkFoYUJzdHJBQXcwclgx?= =?utf-8?B?U2RwWVhmRUNoMjBUdUpXQ2gvT2d0Q2hheVNEWUQ3eHNFd2VoMkxvam5XRWRk?= =?utf-8?B?a0ZnbWNxS01ld1R2enA3OUFVbXJUdE9vWE1YUTB5L2xzRFFlalBtcjRCQy9L?= =?utf-8?Q?aS+AFHtT?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2062;6:xJLcDg1hVYqSdEt26bZxgidYSsum4voS/u/gW1NALLaBux1l1kPlp1ATHqH89xIVc1rPi2T50PV+8k7D+EFjPFdkqGJtxiRNIZnSTr1oDlrgJnmVBHI3DrCLS8fAQVBISd2n6PVHbl7oTXtg3thRqNx3fngDYGe27SWt6ttR4/PaYJ5owK9T/O31l6EXPlX9cOqaFV1T+1wC/SJfOuTUH3Nanz/g7kfINxZ+mivkPCM/iAJvSRb9W/al7bPm/DqAQHnIVgr/eExDR/LDX+R/dXeNdeMaKpEC9p+YveFhXUCT0bn6aIQ4F7kOzJwIGshCck03DU5OC/L18Ri25qhAW/gzjwSAgMsvoedKyytPMK7NAY5TGNlFv/ua/5OTHuLxPfKw6utkc5N8cI9IdyuIQdzMcRvzFIkStLE2t1mhg94=;5:ZCNuJ3t2wSfg5Oo6qIgGxTeZJVACWDimSm4sEvl2rsjByx9HCqnCOf4fry1ykednjCa7dbF6OyVDo7vYFzgYl1edD2sW3yNsUbvsrKWl2dqld/rnOFQ0UfuK+x8kch28Hu9ZaDKrjS54aNT9X46UtQ==;24:7AZvkL2lgljaQDSjFU13A5Y5ydHvWcsmcKlR7zVEwVv7gFrLgzwjFaaTHLL19UzkFDzgUoN1/hUkSUQkeYbzcS90IdH0ogo61KfKjG2ylQc= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2062;7:zD3GAXfAyOibwwx1AJxQ0hdA/+QbgYoecSse+C6Cn3I+VtuAmgTStE7/LcWx+ksebePKjANflE85Atu1rdKA+RLJhF1tKG4rG0dpBYFRzH1vQyGywtBauE99u4UMlg+5x6V9LUHpz9shDy+XXIyKZI7//v2Qg0lWI32CDzEbnPtbVLTTbhbpDDCmX5oyzmt1MNXTEsLSrM9KirJtKgBw4BifZCeNgu+I4I/fPtVbNxq2Vqr6zdeI/0Y/AoYwquAakkMh+aiLBE073oL2TYUf5jHe1iOlanvixo9tZg0dJlDIDc5GzwpS1g1UhQz4pLGarkIOjrpsnvoIm1h4EH6ZUg2v+V82d+HfA4/8+iI1X6EDGWfWSP+ZIkweEzh5Ul7koIxp09jPfNHVdifeLnBLc9X51rnYO1W5HEhXfbhfcdaKdEoQO6lJHLYU9IBjHICSAsO31JWbYHfWzUxdfZlvcA==;20:YkCZ50aE6C6ogYdVJ+WqaDWwJG6foXwP/vhbYu4DRoTxYamTXtTliM4u44Omo58K+8VILYwf/Q2a/STGYDCWE0B9koI5UAH98aTOxnIMujliQRmy0ZwyV7XhRYbqZiyOFSwvc7RgGT0JKCeVb+K8er2IBpkURnAmgWpCz7Y6Ags= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jan 2017 19:14:54.0042 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2062 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/25/2017 08:23 PM, Borislav Petkov wrote: > On Wed, Jan 25, 2017 at 07:58:39PM +0300, Andrey Ryabinin wrote: >> On 4.10-rc5 >> # echo 0 > /sys/devices/system/cpu/cpu1/online >> # echo 1 > /sys/devices/system/cpu/cpu1/online >> >> triggers use-after-free (probably caused by 06b8534cb72 "x86/microcode: Rework microcode loading"). >> >> __load_ucode_intel() accesses initrd which is obviously gone at this point: > > Does that help? Yup. Tested-by: Andrey Ryabinin > > --- > diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c > index 2af69d27da62..fdbf8d29ffcf 100644 > --- a/arch/x86/kernel/cpu/microcode/core.c > +++ b/arch/x86/kernel/cpu/microcode/core.c > @@ -248,8 +248,12 @@ struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa) > * possibly relocates the ramdisk. In either case, initrd_start contains > * the updated address so use that instead. > */ > - if (!use_pa && initrd_start) > - start = initrd_start; > + if (!use_pa) { > + if (initrd_start) > + start = initrd_start; > + else > + return (struct cpio_data){ NULL, 0, "" }; > + } > > return find_cpio_data(path, (void *)start, size, NULL); > #else /* !CONFIG_BLK_DEV_INITRD */ >