Messages in this thread Patch in this message | | | Date | Fri, 15 Jul 2022 22:09:01 +0900 | Subject | [PATCH v2] ARM: spectre-v2: fix smp_processor_id() warning | From | Tetsuo Handa <> |
| |
syzbot is reporting that CONFIG_HARDEN_BRANCH_PREDICTOR=y + CONFIG_DEBUG_PREEMPT=y on ARM32 causes "BUG: using smp_processor_id() in preemptible code" message [1], for this check was not designed to handle attempts to access kernel memory like
---------- int main() { return *(char *) -1; } ----------
. Although Russell King commented that this BUG: message might help finding possible exploit attempts [2], this is not a kernel's problem that worth giving up fuzz testing.
This patch explicitly disables preemption and uses raw_smp_processor_id().
Link: https://syzkaller.appspot.com/bug?extid=a7ee43e564223f195c84 [1] Link: https://lkml.kernel.org/r/YrMhVAev9wMAA8tl@shell.armlinux.org.uk [2] Reported-by: syzbot <syzbot+a7ee43e564223f195c84@syzkaller.appspotmail.com> Fixes: f5fe12b1eaee220c ("ARM: spectre-v2: harden user aborts in kernel space") Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> --- arch/arm/include/asm/system_misc.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/arch/arm/include/asm/system_misc.h b/arch/arm/include/asm/system_misc.h index 98b37340376b..670e8d116770 100644 --- a/arch/arm/include/asm/system_misc.h +++ b/arch/arm/include/asm/system_misc.h @@ -20,10 +20,13 @@ typedef void (*harden_branch_predictor_fn_t)(void); DECLARE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn); static inline void harden_branch_predictor(void) { - harden_branch_predictor_fn_t fn = per_cpu(harden_branch_predictor_fn, - smp_processor_id()); + harden_branch_predictor_fn_t fn; + + preempt_disable_notrace(); + fn = per_cpu(harden_branch_predictor_fn, raw_smp_processor_id()); if (fn) fn(); + preempt_enable_no_resched_notrace(); } #else #define harden_branch_predictor() do { } while (0) -- 2.34.1
| |