From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D7E4A2D6409 for ; Thu, 5 Feb 2026 11:07:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770289643; cv=none; b=fj62M1h5VQEmJ+khE2nQdx/WDgXo7YKNqDeaUkyoi0Ch00lZdBkay7Oc4yaH/RtKFXv/yt6tVE1lPNHA/0T3esyjG/xrB/bu/vE30p6yjwDCaXfpMm+u27aO+8wx/u7BFjHyRK12jLWjuLB12VXnbjNvSp6By9nZsbzz9p96GKY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770289643; c=relaxed/simple; bh=N/KIzvnjl0M5Frr/AFSx0UfsoSryrma+N2UXKRCgquw=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=LRHqDvZ5xiT2L9bs/zgrOjrIT5yDAurrgTdoAxDWNbXw2vh3gzVlbrS+CpfAWcuVK8NrW6mI7r92bMKcG2F6/AfS0eaQ8aQy/M9aPWm9N/fPgqy1K5vyc6/jJPqmDeIsgi6NzHEdca096LepEyW/Is2B9gRfCqM7jvGSVlS+L9I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=XALQmbvv; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="XALQmbvv" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=X9uRY5SHnfKYQrtx9QM3lPHLzP38E/NMFmo7FbR8cEw=; b=XALQmbvvK0RumMMxIto6U3tXxu BX06zX2T7O1If7Zp3T6caFB1v9UtGYmSnKJtcKNjrrxCLgbuoNIF4d5togSOI4z9fHCkYiriuUR7d uDczZGXhlngyiUozHRJxz7YmB2W4zw2u4lxnsfv4EmRjBrfRh6RNDreV1fVXYidAfooAH3d+IB7cP vVlWF04P8VFBfFYcvx3uee3gVizMKsxLONyaIZVHNHfCx7r+leXLk2Szk8+fzEwIzqcN+ZSMrGTwH snFNKke3kIzJCeEjzQTVhEMKAlZBf1zxCBUSCnnB1SJHnXi3vtGrA/3sCkWH34H3oe70XrYF4XIHC 94bpD6PQ==; Received: from 2001-1c00-8d85-5700-266e-96ff-fe07-7dcc.cable.dynamic.v6.ziggo.nl ([2001:1c00:8d85:5700:266e:96ff:fe07:7dcc] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.98.2 #2 (Red Hat Linux)) id 1vnxCS-00000003W62-3OVP; Thu, 05 Feb 2026 11:07:04 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id 4F048300BD2; Thu, 05 Feb 2026 11:57:04 +0100 (CET) Date: Thu, 5 Feb 2026 11:57:04 +0100 From: Peter Zijlstra To: Chuyi Zhou Cc: tglx@linutronix.de, mingo@redhat.com, luto@kernel.org, paulmck@kernel.org, muchun.song@linux.dev, bp@alien8.de, dave.hansen@linux.intel.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH 05/11] smp: Enable preemption early in smp_call_function_many_cond Message-ID: <20260205105704.GA245049@noisy.programming.kicks-ass.net> References: <20260203112401.3889029-1-zhouchuyi@bytedance.com> <20260203112401.3889029-6-zhouchuyi@bytedance.com> <20260205095236.GI232055@noisy.programming.kicks-ass.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260205095236.GI232055@noisy.programming.kicks-ass.net> On Thu, Feb 05, 2026 at 10:52:36AM +0100, Peter Zijlstra wrote: > On Tue, Feb 03, 2026 at 07:23:55PM +0800, Chuyi Zhou wrote: > > > + /* > > + * Prevent the current CPU from going offline. > > + * Being migrated to another CPU and calling csd_lock_wait() may cause > > + * UAF due to smpcfd_dead_cpu() during the current CPU offline process. > > + */ > > + migrate_disable(); > > This is horrible crap. migrate_disable() is *NOT* supposed to be used to > serialize cpu hotplug. This was too complicated or something? --- a/kernel/smp.c +++ b/kernel/smp.c @@ -802,19 +802,20 @@ static void smp_call_function_many_cond( unsigned int scf_flags, smp_cond_func_t cond_func) { - int cpu, last_cpu, this_cpu = smp_processor_id(); - struct call_function_data *cfd; + struct call_function_data *cfd = this_cpu_ptr(&cfd_data); + struct cpumask *cpumask = cfd->cpumask; bool wait = scf_flags & SCF_WAIT; - bool preemptible_wait = true; cpumask_var_t cpumask_stack; - struct cpumask *cpumask; + int cpu, last_cpu, this_cpu; int nr_cpus = 0; bool run_remote = false; - lockdep_assert_preemption_disabled(); + if (wait && !alloc_cpumask_var(&cpumask_stack, GFP_ATOMIC)) + cpumask = cpumask_stack; - if (!alloc_cpumask_var(&cpumask_stack, GFP_ATOMIC)) - preemptible_wait = false; + cpus_read_lock(); + preempt_disable(); + this_cpu = smp_processor_id(); /* * Can deadlock when called with interrupts disabled. @@ -836,10 +837,6 @@ static void smp_call_function_many_cond( /* Check if we need remote execution, i.e., any CPU excluding this one. */ if (cpumask_any_and_but(mask, cpu_online_mask, this_cpu) < nr_cpu_ids) { - cfd = this_cpu_ptr(&cfd_data); - - cpumask = preemptible_wait ? cpumask_stack : cfd->cpumask; - cpumask_and(cpumask, mask, cpu_online_mask); __cpumask_clear_cpu(this_cpu, cpumask); @@ -897,6 +894,7 @@ static void smp_call_function_many_cond( csd_do_func(func, info, NULL); local_irq_restore(flags); } + preempt_enable(); if (run_remote && wait) { for_each_cpu(cpu, cpumask) { @@ -907,8 +905,8 @@ static void smp_call_function_many_cond( } } - if (preemptible_wait) - free_cpumask_var(cpumask_stack); + cpus_read_unlock(); + free_cpumask_var(cpumask_stack); } /**