Received: by 2002:a5b:505:0:0:0:0:0 with SMTP id o5csp1048087ybp; Thu, 17 Oct 2019 07:19:55 -0700 (PDT) X-Google-Smtp-Source: APXvYqwBBqlutqbLKw2hi8mqQmVilTKMtnJzLsTsHmWz5HoC99LIFT6CHDsahPHsvuLS4offwbN6 X-Received: by 2002:a50:eb4d:: with SMTP id z13mr3949403edp.175.1571321995788; Thu, 17 Oct 2019 07:19:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1571321995; cv=none; d=google.com; s=arc-20160816; b=AzAFfloRhLgf+atqAFc0W5tnyOibu2ND7x7aGT7WElY2XITwEGmqObMREFzuwkQUrY f4ItmiyI9NiRUBfmaZEzbyF9EGdBNEUP5n/KwHySRe2CwiIXEOyc1RIqBuwCd7eeBD1o gvCRu7XXkWft8lGTbIVsFoVQOz4WDiQVEajjOGKWh8yau588zMXTqKRzykcsFCShzOYZ paE5elXLah0SMPRWtBGU5hJai+qDbrpAr2WV9prMt6q1ADcknWQQ07d5ZEXurL1GLGtc L8emUQQZq93MRk1O4cG+saZjpWU50S2zTn6P3sTpcXVZQ4Q+uRt3eIdiJXHzKLNJbIoP fTFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=VYWdufTlEDqoflHxmFHENqNRVaZ6b1YL1pEYSpJPcOI=; b=rM6C5LNv6DZBE1xgSgMScUSvatRYj3+uOgB1rNf6gZqWOBTDssylJ5sc3UDDDohnpQ jsJShi780OQQiV3C0F3zlqb32uy/P0TP/CaL/d39RKWH8Fm7bRUd4JbTlWT3niJfXT3Y 29/svmrbMWMm99Z+ZOCJfYXpFf/X+REJrDoI8wp6TFKJv5j4E0s2acdcJcDMawDy8Fh2 OAemjziYHftw+kQ10X5+CTcRKsv1VkRL2WHxMnlijXSb8/U2xDJvtHiwxzPZu+H/d7h+ gZmRJiOHp7EEhfS5R7SZb3OwFM0dpjsB+GjHjm547UPdJ7ouy4uFxbxMRN/XjKPfUfSZ wVHg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=voKsnQzK; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l12si1915026edk.444.2019.10.17.07.19.32; Thu, 17 Oct 2019 07:19:55 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=voKsnQzK; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2395023AbfJPVye (ORCPT + 99 others); Wed, 16 Oct 2019 17:54:34 -0400 Received: from mail.kernel.org ([198.145.29.99]:44064 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388866AbfJPVyS (ORCPT ); Wed, 16 Oct 2019 17:54:18 -0400 Received: from localhost (unknown [192.55.54.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A6B5C21A4C; Wed, 16 Oct 2019 21:54:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571262858; bh=kYzjHFeSJmYMO6kYfEMX+vU+jy9Iq1brizrumZUAVe8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=voKsnQzKq7FrAGwg4J1S3QS2RRSzqJbF6V/pc4uYxL6JCLJ9r9jUFxRbBbCSQeEOz GjQGCsEIxARygVMbcaOKOCmc5FlojKJ6KJ9h7tFF5GAs3mXi4iUAZBNNqEEZObZAL1 S589xn1Ah640MvQbnfbva/mY5mYqpsvGCJ5DM5xI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, KeMeng Shi , "Peter Zijlstra (Intel)" , Valentin Schneider , Linus Torvalds , Thomas Gleixner , Ingo Molnar , Sasha Levin Subject: [PATCH 4.9 24/92] sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() Date: Wed, 16 Oct 2019 14:49:57 -0700 Message-Id: <20191016214819.797335164@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191016214759.600329427@linuxfoundation.org> References: <20191016214759.600329427@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: KeMeng Shi [ Upstream commit 714e501e16cd473538b609b3e351b2cc9f7f09ed ] An oops can be triggered in the scheduler when running qemu on arm64: Unable to handle kernel paging request at virtual address ffff000008effe40 Internal error: Oops: 96000007 [#1] SMP Process migration/0 (pid: 12, stack limit = 0x00000000084e3736) pstate: 20000085 (nzCv daIf -PAN -UAO) pc : __ll_sc___cmpxchg_case_acq_4+0x4/0x20 lr : move_queued_task.isra.21+0x124/0x298 ... Call trace: __ll_sc___cmpxchg_case_acq_4+0x4/0x20 __migrate_task+0xc8/0xe0 migration_cpu_stop+0x170/0x180 cpu_stopper_thread+0xec/0x178 smpboot_thread_fn+0x1ac/0x1e8 kthread+0x134/0x138 ret_from_fork+0x10/0x18 __set_cpus_allowed_ptr() will choose an active dest_cpu in affinity mask to migrage the process if process is not currently running on any one of the CPUs specified in affinity mask. __set_cpus_allowed_ptr() will choose an invalid dest_cpu (dest_cpu >= nr_cpu_ids, 1024 in my virtual machine) if CPUS in an affinity mask are deactived by cpu_down after cpumask_intersects check. cpumask_test_cpu() of dest_cpu afterwards is overflown and may pass if corresponding bit is coincidentally set. As a consequence, kernel will access an invalid rq address associate with the invalid CPU in migration_cpu_stop->__migrate_task->move_queued_task and the Oops occurs. The reproduce the crash: 1) A process repeatedly binds itself to cpu0 and cpu1 in turn by calling sched_setaffinity. 2) A shell script repeatedly does "echo 0 > /sys/devices/system/cpu/cpu1/online" and "echo 1 > /sys/devices/system/cpu/cpu1/online" in turn. 3) Oops appears if the invalid CPU is set in memory after tested cpumask. Signed-off-by: KeMeng Shi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/1568616808-16808-1-git-send-email-shikemeng@huawei.com Signed-off-by: Ingo Molnar Signed-off-by: Sasha Levin --- kernel/sched/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 63be0bcfa286d..82cec9a666e7b 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -1162,7 +1162,8 @@ static int __set_cpus_allowed_ptr(struct task_struct *p, if (cpumask_equal(&p->cpus_allowed, new_mask)) goto out; - if (!cpumask_intersects(new_mask, cpu_valid_mask)) { + dest_cpu = cpumask_any_and(cpu_valid_mask, new_mask); + if (dest_cpu >= nr_cpu_ids) { ret = -EINVAL; goto out; } @@ -1183,7 +1184,6 @@ static int __set_cpus_allowed_ptr(struct task_struct *p, if (cpumask_test_cpu(task_cpu(p), new_mask)) goto out; - dest_cpu = cpumask_any_and(cpu_valid_mask, new_mask); if (task_running(rq, p) || p->state == TASK_WAKING) { struct migration_arg arg = { p, dest_cpu }; /* Need help from migration thread: drop lock and wait. */ -- 2.20.1