From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933098AbdGSWgv (ORCPT ); Wed, 19 Jul 2017 18:36:51 -0400 Received: from esa5.hgst.iphmx.com ([216.71.153.144]:5225 "EHLO esa5.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932518AbdGSWgu (ORCPT ); Wed, 19 Jul 2017 18:36:50 -0400 X-IronPort-AV: E=Sophos;i="5.40,381,1496073600"; d="scan'208";a="34657887" From: Ethan Barnes To: "linux-kernel@vger.kernel.org" CC: Thomas Gleixner , "Srivatsa S. Bhat" , Paul McKenney , Ingo Molnar , Sebastian Siewior Subject: [PATCH] cpu hotplug: Prevent Page Fault in cpuhp_remove_callbacks() Thread-Topic: [PATCH] cpu hotplug: Prevent Page Fault in cpuhp_remove_callbacks() Thread-Index: AQHTAN9l6m7XpnubtUGW0y9N2JNc5A== Date: Wed, 19 Jul 2017 22:36:00 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=wdc.com; x-originating-ip: [63.158.132.10] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;DM2PR04MB399;20:OQgn2AWT3fXZyKV4pDe0thB52AQ6HiN1cfSjmpf7PP6+JDJylDCaNu+jPn2GKlM8uA2GXrEeQvhJ5OURZIXvo7t8SBLIyuCwmNw2xKUbgP0sXUFrQYLzVXBTFpTCfJq9J9HbcyeouSaPqGkDca8fAlFaWjCASKr3xI2SfuNegUE= x-ms-office365-filtering-correlation-id: 33fa9856-c1b1-4065-76e3-08d4cef6883d x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(48565401081)(2017052603031)(201703131423075)(201703031133081)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:DM2PR04MB399; x-ms-traffictypediagnostic: DM2PR04MB399: wdcipoutbound: EOP-TRUE x-exchange-antispam-report-test: UriScan:(236129657087228)(42932892334569); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(5005006)(2017060910075)(8121501046)(100000703101)(100105400095)(93006095)(93001095)(10201501046)(3002001)(6055026)(6041248)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123558100)(20161123564025)(20161123560025)(6072148)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:DM2PR04MB399;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:DM2PR04MB399; x-forefront-prvs: 0373D94D15 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(6009001)(39400400002)(39410400002)(39450400003)(39850400002)(39840400002)(39860400002)(6916009)(3660700001)(3846002)(2351001)(110136004)(305945005)(966005)(50986999)(6116002)(53936002)(38730400002)(5660300001)(66066001)(14454004)(2906002)(54356999)(72206003)(7736002)(33656002)(74316002)(4326008)(6436002)(81166006)(6306002)(5640700003)(2501003)(54906002)(8936002)(5250100002)(9686003)(6506006)(478600001)(25786009)(3280700002)(55016002)(86362001)(2900100001)(99286003)(189998001)(102836003)(7696004)(8676002);DIR:OUT;SFP:1102;SCL:1;SRVR:DM2PR04MB399;H:DM2PR04MB398.namprd04.prod.outlook.com;FPR:;SPF:None;MLV:sfv;LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-OriginatorOrg: wdc.com X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2017 22:36:00.7684 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b61c8803-16f3-4c35-9b17-6f65f441df86 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR04MB399 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v6JMauPx032265 Hi, There is a page fault in cpu hotplug when removing the callbacks for the last dynamic state. The last dynamic state will not be removed, causing a page fault when hotplug thinks the callbacks still exists and calls it. The problem is as follows: - __cpuhp_remove_state() eventually calls cpuhp_store_callbacks() with NULLs for most params. - If state is the last state (i.e. CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_STATE) then cpuhp_store_callbacks() calls cpuhp_reserve_state(), which returns the *next* available DYN state. - The NULLs are stored in that *next* state (i.e. AP_ONLINE_DYN + 1 or BP_PREPARE_DYN + 1) instead of in AP_ONLINE_DYN or BP_PREPARE_DYN. Thus, the last state is never cleared. The callbacks now point to invalid memory. - When the cpu is onlined again and/or offlined, then the invalid callback is invoked, causing a page fault. The patch above solves this by detecting when a state is being removed, and not calling cpuhp_reserve_state(). I have brought this up before, but hoping to get some traction on it this time: https://lkml.org/lkml/2017/7/5/574 Thx, Ethan Signed-off-by: Ethan Barnes --- diff --git a/kernel/cpu.c b/kernel/cpu.c index eee0331..f7fda16 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -1252,7 +1252,8 @@ static int cpuhp_store_callbacks(enum cpuhp_state state, const char *name, struct cpuhp_step *sp; int ret = 0; - if (state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN) { + if (name && + (state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN)) { ret = cpuhp_reserve_state(state); if (ret < 0) return ret;