Messages in this thread | | | Date | Wed, 22 Jun 2022 14:50:15 +0100 | From | Marc Zyngier <> | Subject | Re: [PATCH] ARM: spectre-v2: fix smp_processor_id() warning |
| |
On 2022-06-22 07:49, Tetsuo Handa wrote: > syzbot complains smp_processor_id() from harden_branch_predictor() > from page fault path [1]. Explicitly disable preemption and use > raw_smp_processor_id(). > > Link: https://syzkaller.appspot.com/bug?extid=a7ee43e564223f195c84 [1] > Reported-by: syzbot > <syzbot+a7ee43e564223f195c84@syzkaller.appspotmail.com> > Fixes: f5fe12b1eaee220c ("ARM: spectre-v2: harden user aborts in kernel > space") > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > --- > This patch is completely untested. > > arch/arm/include/asm/system_misc.h | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/arch/arm/include/asm/system_misc.h > b/arch/arm/include/asm/system_misc.h > index 98b37340376b..a92446769acd 100644 > --- a/arch/arm/include/asm/system_misc.h > +++ b/arch/arm/include/asm/system_misc.h > @@ -20,8 +20,11 @@ typedef void (*harden_branch_predictor_fn_t)(void); > DECLARE_PER_CPU(harden_branch_predictor_fn_t, > harden_branch_predictor_fn); > static inline void harden_branch_predictor(void) > { > - harden_branch_predictor_fn_t fn = per_cpu(harden_branch_predictor_fn, > - smp_processor_id()); > + harden_branch_predictor_fn_t fn; > + > + preempt_disable_notrace(); > + fn = per_cpu(harden_branch_predictor_fn, raw_smp_processor_id()); > + preempt_enable_no_resched_notrace(); > if (fn) > fn(); > }
I don't think that's required.
harden_branch_predictor() is always called on the fault path, from __do_user_fault(), and that's always non-preemptible.
My hunch is that we're missing some tracking that indicates to the kernel that we're already non-preemptible by virtue of being in an exception handler.
Russell, what do you think?
M. -- Jazz is not dead. It just smells funny...
| |