kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

x86/mtrr: Prevent CPU hotplug lock recursion

Browse source 
Larry reported a CPU hotplug lock recursion in the MTRR code.

============================================
WARNING: possible recursive locking detected

systemd-udevd/153 is trying to acquire lock:
 (cpu_hotplug_lock.rw_sem){.+.+.+}, at: [<c030fc26>] stop_machine+0x16/0x30
 
 but task is already holding lock:
  (cpu_hotplug_lock.rw_sem){.+.+.+}, at: [<c0234353>] mtrr_add_page+0x83/0x470

....

 cpus_read_lock+0x48/0x90
 stop_machine+0x16/0x30
 mtrr_add_page+0x18b/0x470
 mtrr_add+0x3e/0x70

mtrr_add_page() holds the hotplug rwsem already and calls stop_machine()
which acquires it again.

Call stop_machine_cpuslocked() instead.

Reported-and-tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1708140920250.1865@nanos
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Cc: Borislav Petkov <bp@suse.de>
This commit is contained in:
Thomas Gleixner 2017-08-15 13:03:47 +02:00
parent b45e4c45b1
commit 84393817db
1 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
arch/x86/kernel/cpu/mtrr/main.c
View file

@ -237,6 +237,18 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
stop_machine(mtrr_rendezvous_handler, &data, cpu_online_mask); stop_machine(mtrr_rendezvous_handler, &data, cpu_online_mask);
} }
static void set_mtrr_cpuslocked(unsigned int reg, unsigned long base,
unsigned long size, mtrr_type type)
{
struct set_mtrr_data data = { .smp_reg = reg,
.smp_base = base,
.smp_size = size,
.smp_type = type
};
stop_machine_cpuslocked(mtrr_rendezvous_handler, &data, cpu_online_mask);
}
static void set_mtrr_from_inactive_cpu(unsigned int reg, unsigned long base, static void set_mtrr_from_inactive_cpu(unsigned int reg, unsigned long base,
unsigned long size, mtrr_type type) unsigned long size, mtrr_type type)
{ {
@ -370,7 +382,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
/* Search for an empty MTRR */ /* Search for an empty MTRR */
i = mtrr_if->get_free_region(base, size, replace); i = mtrr_if->get_free_region(base, size, replace);
if (i >= 0) { if (i >= 0) {
set_mtrr(i, base, size, type); set_mtrr_cpuslocked(i, base, size, type);
if (likely(replace < 0)) { if (likely(replace < 0)) {
mtrr_usage_table[i] = 1; mtrr_usage_table[i] = 1;
} else { } else {
@ -378,7 +390,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
if (increment) if (increment)
mtrr_usage_table[i]++; mtrr_usage_table[i]++;
if (unlikely(replace != i)) { if (unlikely(replace != i)) {
set_mtrr(replace, 0, 0, 0); set_mtrr_cpuslocked(replace, 0, 0, 0);
mtrr_usage_table[replace] = 0; mtrr_usage_table[replace] = 0;
} }
} }
@ -506,7 +518,7 @@ int mtrr_del_page(int reg, unsigned long base, unsigned long size)
goto out; goto out;
} }
if (--mtrr_usage_table[reg] < 1) if (--mtrr_usage_table[reg] < 1)
set_mtrr(reg, 0, 0, 0); set_mtrr_cpuslocked(reg, 0, 0, 0);
error = reg; error = reg;
out: out:
mutex_unlock(&mtrr_mutex); mutex_unlock(&mtrr_mutex);