From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751924AbdAYQ5z (ORCPT ); Wed, 25 Jan 2017 11:57:55 -0500 Received: from mail-ve1eur01on0093.outbound.protection.outlook.com ([104.47.1.93]:59648 "EHLO EUR01-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751016AbdAYQ5x (ORCPT ); Wed, 25 Jan 2017 11:57:53 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; To: Borislav Petkov , Thomas Gleixner From: Andrey Ryabinin Subject: x86/microcode: use-after-free after cpu offline/online CC: LKML , "H. Peter Anvin" , Ingo Molnar Message-ID: <3e4b6f03-384d-411e-5243-9d3b0595d5cb@virtuozzo.com> Date: Wed, 25 Jan 2017 19:58:39 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: AM4PR02CA0008.eurprd02.prod.outlook.com (10.165.239.146) To DB6PR0801MB2054.eurprd08.prod.outlook.com (10.168.86.135) X-MS-Office365-Filtering-Correlation-Id: 582205bb-c04f-4192-2b56-08d445434b90 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DB6PR0801MB2054; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;3:VSZfZd4l5oOWMOJTQF8EOp54IMrA1uprG8ChKcKPUnm5kN4KcM/6E2rcTz8uF9uLNV6qufDfy8L4SXb+bTYGycdkeOUf5DwCcL6Mt5ABeuJQqxfa2FH1+doBUvVpSj0zK/b4mo/GlMYS5DWTSbxBQWsB3hEAjcbeLKJyFXxNttLNf+3jUjIxvLDqiWcd0NyGMI+m4eCPFdsULnL1srCc5R6v/KCt9VyRb2/mBPLq6f1oUnRhmCme7xX7Gk5AZFcXcrrAVShWPP4uLHjo9DBKIA==;25:xfQzTHhpRI2l1Y2S8p1oLWUsQYouSzzEBZnLc5VJOFuqcF7eL38d1lddnTR1JoCFp2CrSLz65Cl0FWdv7RAu1frEfRIDMj3KaC2POMfcHiWGDo3vnzqbFEtn9BVRFTGu7JFQcrQLKL3lMrJ/6wG8IhgVhFHLEPvcmSnwy9sqzCxkxZ/9SVafVL6gxaJmitse+lpLFGQ3N7nlFnn4eBef6oYpf+qVzAS8BD0WFQ2XSeBc0efKFkHMEn714kR3r1zA0srOwoPx2+0j8iylkal5urFiNAi1NnP5PkIlHvPooSJeQrMXnivQzQPDxWZU3W2AYR976QY0dexuD9Iba5v8btYApSJX8oW51tkO+G0/jd0wr/D7mDEBFCpSlEtzbIbb86X2RtkRN7JnN6zUVSMziL4pMm/ofEY6/Gy5qOi5Xg7o4wi7yi/23vJZIB8MC1Yzc/g2Rw64I8qddFD2fzSV+Q== X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;31:BWOr+o+PidCh2MNbfbiXwS3c9hwh7gqa8yM18x7IdPW7I66bCoPAUBllJxvUUnrHd6m5zhLQ0PckjSDPDB/AL/OPoVk4ADNL/eHNx87Z9aWA3s28NNy4Plo32nwxwgPzkG6xbPDSnGUaNaCNv0lKJsm5Fr0x+FdReDgded/czgwBD+SooqX9ez7RzlbTK7xSdKZALhb2nEtnanAWTGtWhyn+qUibdF+5cMse6x+ulO6H/+iTCX9xSPRBStqavGqqZA1eFXogEwXpedC6SADUtT9r9hrP5HzFzXdkYJG0mSw=;20:YO/bgZ3AR79qnEXLlXTF+sR+zBLN1nhBfDhDLoI+6iidArFVpp4BTN6v53X6ZQikqaizco7ckDns2IsIfDAPdJcViYMx9ulYw9dTU2q6lfJPerM1z1MZgyFEh9I1valfOhvWzfv+3UoWL4qXYJUrlxhDfuXhVREHV8cgiROGwCNtCbXJm+HbKJ7llh4us4XetSqTbogRlgUZF6O2RBp4Ie26WNVcA0WtpdWUFr7lTEACpSip7US4CbFBR/4TGHPE X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(209352067349851); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6041248)(20161123560025)(20161123562025)(20161123555025)(20161123564025)(6072148);SRVR:DB6PR0801MB2054;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB2054; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;4:JlL7AtI8NjkCHvHrjJO1abdbrhAovs6MbNPI2Af5Aq3IgVcmu9kUIi8CFRql2pq7BVDFi3ovKS0/tTGNaj5R1PPyMcyI0b5C6aoslS66F4HdCyam1MEE9mmNcDh4Y8yfjZoORkT50b8FsvmK7Hj9cOH1aTkhGot8cz+PNJh6JmU2pk9qAhLAce3cfzLV+YZ1DrvbuqTvJOfY1Y6AfYafQ0fA/qWUVKPt9SDb5tfdrx43/FLn+r3AF4tat9koqoVtkQV/Z/MIfDM2KTxoicE2BsIvXVJcdFIQgAD87bZPp08JD1SAc/0DkmNmhSDvFu5i/IiVhLvtlyNSXfJ5nQgTqtsFwhn4KHxhkrY8nsngr8O6ACBsgmGbDvRSdXzr1YQSP6DvbleK1zpxswXYredSr7MVIsN1c/GMq92d9i8VeDRsRVp0kirkLx/74WCV64TjVwSMoKTaJ33OZkVY5xfh10kNijiXBC6cdZSGsIMM3rpT2kbY5OwOj1AN/3VlBt8uW01mJS/9GXFroa0yZiw1h1y7I9X3FSu+QWKW9lp+mVIQPTsmHf/RPsUFVvkGTWtRzzeInS1L1WaJMfbTKHCCEm/tWePffKa+kY3fhXFQOtd9FDgsWrxLvWyuHH8W1bTg X-Forefront-PRVS: 01986AE76B X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(39830400002)(39450400003)(39410400002)(189002)(199003)(8676002)(50466002)(81156014)(31696002)(81166006)(101416001)(7736002)(33646002)(305945005)(86362001)(4001350100001)(4326007)(36756003)(83506001)(2906002)(97736004)(189998001)(5001770100001)(92566002)(64126003)(38730400001)(23676002)(47776003)(90366009)(66066001)(65806001)(65956001)(54356999)(77096006)(50986999)(25786008)(6486002)(31686004)(53936002)(6116002)(65826007)(105586002)(230700001)(54906002)(5660300001)(3846002)(68736007)(230783001)(106356001)(6666003)(42186005);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0801MB2054;H:[172.16.25.12];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtEQjZQUjA4MDFNQjIwNTQ7MjM6WHczdk8yQTJGZXJHbWtDRWhlaFFRMVNK?= =?utf-8?B?UmJaZTYrOG5MVUg1cXduOFZhZ0orVGlmb283Q2dOLzNmVGJ1NTZ6d0dXa0Jq?= =?utf-8?B?MTY5VHlkY1ZPVFV5SU9BVUY2RXpZNmNCd05EVENGOUJlZG00K2h4Y0xWTVhW?= =?utf-8?B?dUVxem53dHR1RGpDdEtuN2xvSkxvZnpqTlBVaFRWOWpGUTgvZ24vWFp1R210?= =?utf-8?B?M2xEN0luclVzQlBQTmtiRTduMGZYWEFEdHB2UTBqRlU3bDRHVzBmNDZNaElo?= =?utf-8?B?S1o4U3JhUkN5MHk0RExicXQ0Q2xTVDJSYktPNjFwMGI3eVE4Q2xiVjY2NTEw?= =?utf-8?B?Y3pZUGt0c1ppRGxFaEN2eGorZUlCZVd6cE9vYm5TOWQzWGcwYXFjcysydGdI?= =?utf-8?B?R1ZaV3NBY0V1VDZ0Qk9pZk1obVRDVmJIcjhxNnVMTTdSeFJWcjVybkcwQ0h5?= =?utf-8?B?c1dyUzBkeG5rZURCYVNxL3NDa2xoUC9QZjZFRWVIR0w0RDZVaGEvZkFKdDF1?= =?utf-8?B?b242Ump0QWR1Q2NONmtGN01HYjNsUkdtYnUrOUFPd1pIQjFZdGJ2WXRyYW1L?= =?utf-8?B?TVUzQUhBSERYOFlsdmphU0psZlNXaUdyNDYwd2pNbVpoWitXRUtJVjdPaGwy?= =?utf-8?B?RzkySEx3ZGNycVhCUWNYZWtvckdWWWVHZUtNdUx0V1VmZWdlWnhrTFBCeHhV?= =?utf-8?B?WDQxaGJZWGpwOU9sT0ZLNEJsVmVGZmlCbWVndWROM1pJNG1zbVV3N0hQcUNi?= =?utf-8?B?OVRmc3BjbC9NSlpkQ2J5Y3lOL3JTNkJXeXZmeFp3dDE4UGZnbkZhWXkzeURv?= =?utf-8?B?Sm9DV2FtVHgyMFBkWVRPd3o5SVZLdXRsU0ZPdTVDWWdSRGEzdVdoTzIxdnMy?= =?utf-8?B?Y3dQZVdNWlNmWDNiUnBiZU1SaVcrRWtXQWlIU2VDMGZwemxkS2pUMTlwRVJw?= =?utf-8?B?UmVLTUZ3TGZXRFNCbEZUQWVkKzQ4eGpFSHd6Z3QvalVFM0lDZ0tyWXIyck82?= =?utf-8?B?U1hGVG8vTzFtZTVhb3VmUkc1eFdoUU5DMVgxNWVPMlVNRjFoSStrZmRBM0c1?= =?utf-8?B?WGxkOXNKMEh5a0ZnZ1hjY2Vsby9KSy9zbGNDNEZiRGlETzVQaGF4ZWFuejhn?= =?utf-8?B?NG43d3hqRWZWSHN3dEZCZ1c3bm1Obktubkk4YS9TR1VHVnNZQ1dGZjZWWito?= =?utf-8?B?a0RGTmhmOGY2ekppMGtIRHlockJSWG00cE0rVmtjTVFpdVllcnpRM2ZEVzQw?= =?utf-8?B?ZlU1VXl1TldndWFZK1dwd01WNEN5U3BFNjJFZGpkTUE4c3dTOVNmNndyNUEr?= =?utf-8?B?bVRqOHdKVzF6NUJXOHVCdktwYytWWThGaW1QVU1TdEVDOEF0d2RYWlN1eTZS?= =?utf-8?B?bWlQVmJJbmJhQXBPNHFESjFFUUpvTGhxdFpwOURoZkpIMVJicDZFeHNDSFpt?= =?utf-8?B?WFdCV0lKczRmczBWKzNUbGg5dDlKSndwYWIyNHUrMEhFcWI0WUJCdGxrTmtY?= =?utf-8?B?c1NCbXlHZ2IwKzhvTVRCNCtFQUZrMU9mUms1dThlbVZQRDdRSnFHU3cxUnBv?= =?utf-8?B?MXdsKy9xUFdoeVpoc0phT2RuaTR5SGRoNnVjVytuM0JYVk1aME1BZGMxOTBH?= =?utf-8?B?b1krMnFIdm5kTVpPSFp5NERMekxYRmlrUU02cnFhK3dUdW14UkdsVkoySWhE?= =?utf-8?B?Y25uQ09Yc3JvcWd0Y0JweHI2WkhOVU9JK0kyQXR0S3U3MG5XaU85UXpHY3RV?= =?utf-8?B?VVpzWmYrcFhVeHRJYkwvMXBKNVJUZEZtNjRGdjVQU3c0bmcrZ2dQTDNwMGo5?= =?utf-8?Q?DnkT3o90AtQx7lG?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;6:jf0SqaVv/F927vhGaXp9+wGWCDzprS3xDECLHZ9oUPQ10CiksSPAVIA/wkktswT2iVvNtxVROY2T0/hidO0LGRV3fi3E+ORQWWSAjrJTa7NWXxMm0Lmf3UxLgG06cizEwq3HlIJd1wZGsN6t0uwfwLMr/7fVjE2N8Kmlbam9GJdcF0oBFn1XguyO0C7W7X/RVVfh348nrbAseEH1P1JkKXlKvKqVx0QxB+Vy1XKJwjFJDVaPLLmlItBCS9kVASdP7PFFPfSsG+5jzbuuTmZ8Ystm0ae6B14lZtKOS1A4Y1bB5PGoRosXo4w3/14S7Eh3nEpoPsLu4lByIBw7xpnEYs3J+iv9G++uChDrhQxKxaiAUTsw/4q9TIEOGfxmifiMT7tLr8eAmWbqaj9RHxI/1IGSODVEn76iMgBVXhPZkK0=;5:ij2ULAcmtQbFI7I2ScxI3fRjSWz3IOtpU2zILvkiceK42QeA751qWRuodd7wgQqWxvJu6Tp65lwjIhKc2/KEwFwktuhLBXEdbAnYE+8kbUf2WuIXCVj0oDCG/3XqmDyWpvMu9yjOf/y/2IxQuIsfKQ==;24:1l3fQAiPKeaAx+uto/NNp5uc35LB8wbdTJMYIE9eu4mDBZ2w3treucgw4vKNxfCmCtpPinOxhB8II6olPBLAFsDTftTpRjeywTpPNGYYntQ= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB2054;7:39ihAL4L1vFY9v4qwOewamMvG56otx7eYgVHb7nxIdqVOH8m9IN//MDLwaOYiPcSeL9hnN6F5UkIK1HcITaP+p2X2O8dJe/193HA8892MPir3hTdexQiY27IGzi0NX81FA8eUEWXKCz6OZOommdy53OnXyxqlQFY0INtAHGtW6kLwZFmze8scjmkQGgxwqsus9kJuzidVFxeFDkPX8Diq9VWT95FNTk7nqp/26rXmgj2JQn6SVClFjuli6R6qbmbX1/GA9X802yyc7kuHXQgKqF+2P2+tHoxMitN2ooBh5PacumxD5TL/O8bohW0BCFiTka7tdVQCQBR1tXqbZx53ePtyqeoa+/cP/MbZmVNb80ZgREuzXwlzwb8eAP1wPzk5wO9K27h9lL+R4+fEZzD8viglw6RxGgVoMQ/6saSl1mqfmluUYYyTaHpGCZIvm1yevGQzxvbi65/65Whu2ECtA==;20:miSacTHKnEARNKsfaQrAJSbkiGW6363k//kG6GltvpoUiITuUnDv7u3v91B3SLo2+Yt05H6JaObpBE+gyXVlYOlYQPddf1LcuTAP/8D3tOWjMWvJLYgVF+IiXIUE0W3WKVOGCnzzNWzKt8i9ivWOkxUGSHGblzTf+rzJhQgJi+E= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jan 2017 16:57:49.4413 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB2054 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 4.10-rc5 # echo 0 > /sys/devices/system/cpu/cpu1/online # echo 1 > /sys/devices/system/cpu/cpu1/online triggers use-after-free (probably caused by 06b8534cb72 "x86/microcode: Rework microcode loading"). __load_ucode_intel() accesses initrd which is obviously gone at this point: [ 62.347662] ================================================================== [ 62.347670] BUG: KASAN: use-after-free in find_cpio_data+0x779/0x850 at addr ffff880036e75000 [ 62.347672] Read of size 1 by task swapper/1/0 [ 62.347675] page:ffffea0000db9d40 count:0 mapcount:0 mapping: (null) index:0x1 [ 62.347677] flags: 0x100000000000000() [ 62.347680] raw: 0100000000000000 0000000000000000 0000000000000001 00000000ffffffff [ 62.347682] raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000 [ 62.347682] page dumped because: kasan: bad access detected [ 62.347685] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 4.10.0-rc5-debug-00075-g2dbde22 #3 [ 62.347686] Hardware name: Dell Inc. XPS 13 9360/0839Y6, BIOS 1.2.3 12/01/2016 [ 62.347687] Call Trace: [ 62.347690] dump_stack+0xb1/0x10c [ 62.347693] ? _atomic_dec_and_lock+0xc4/0xc4 [ 62.347696] ? __dump_page+0x529/0x760 [ 62.347699] kasan_report_error+0x5ba/0x8b0 [ 62.347702] ? pointer+0xe70/0xe70 [ 62.347704] ? find_cpio_data+0x779/0x850 [ 62.347706] __asan_report_load1_noabort+0x59/0x80 [ 62.347708] ? find_cpio_data+0x779/0x850 [ 62.347711] find_cpio_data+0x779/0x850 [ 62.347713] ? vsprintf+0x20/0x20 [ 62.347716] ? dump_stack+0x10c/0x10c [ 62.347718] ? get_ucode_user+0x50/0x50 [ 62.347721] ? print_usage_bug+0x6e0/0x6e0 [ 62.347724] find_microcode_in_initrd+0x25f/0x330 [ 62.347726] __load_ucode_intel+0xde/0x120 [ 62.347728] ? collect_cpu_info_early+0x360/0x360 [ 62.347731] ? debug_check_no_locks_freed+0x330/0x330 [ 62.347733] load_ucode_intel_ap+0x8b/0xc0 [ 62.347735] ? collect_cpu_info+0x4e0/0x4e0 [ 62.347737] ? trace_hardirqs_on+0xd/0x10 [ 62.347740] ? flat_send_IPI_mask_allbutself+0xf0/0xf0 [ 62.347741] load_ucode_ap+0x15d/0x180 [ 62.347743] ? get_builtin_firmware+0x160/0x160 [ 62.347746] ? flush_tlb_func+0x690/0x690 [ 62.347749] ? do_raw_spin_trylock+0x110/0x110 [ 62.347752] ? cpumask_weight+0x50/0x50 [ 62.347754] cpu_init+0x7b7/0x1580 [ 62.347756] ? trace_hardirqs_off+0xd/0x10 [ 62.347758] ? play_dead_common+0x30/0x40 [ 62.347760] ? native_play_dead+0x76/0x1c0 [ 62.347762] ? hlt_play_dead+0x40/0x40 [ 62.347764] ? syscall_init+0x140/0x140 [ 62.347766] ? arch_cpu_idle_dead+0x2d/0x40 [ 62.347769] ? do_idle+0x1da/0x2f0 [ 62.347771] start_secondary+0x14/0x370 [ 62.347774] start_cpu+0x14/0x14 [ 62.347776] Memory state around the buggy address: [ 62.347778] ffff880036e74f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.347780] ffff880036e74f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.347782] >ffff880036e75000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.347783] ^ [ 62.347785] ffff880036e75080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.347786] ffff880036e75100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 62.347787] ==================================================================