Received-SPF: pass (google.com: domain of linux-kernel+bounces-126983-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <574d000e-318f-4d3c-81b7-63bb656ac462@amd.com>
Date: Mon, 1 Apr 2024 14:18:25 -0500
User-Agent: Mozilla Thunderbird
Reply-To: babu.moger@amd.com
Subject: Re: [PATCH V2] x86/resctrl: Fix uninitialized memory read when last
 CPU of domain goes offline
To: Reinette Chatre <reinette.chatre@intel.com>, fenghua.yu@intel.com,
 bp@alien8.de, james.morse@arm.com, tony.luck@intel.com,
 peternewman@google.com, tglx@linutronix.de, mingo@redhat.com,
 dave.hansen@linux.intel.com, x86@kernel.org
Cc: hpa@zytor.com, james.greenhalgh@arm.com, linux-kernel@vger.kernel.org
References: <ff8dfc8d3dcb04b236d523d1e0de13d2ef585223.1711993956.git.reinette.chatre@intel.com>
Content-Language: en-US
From: "Moger, Babu" <babu.moger@amd.com>
In-Reply-To: <ff8dfc8d3dcb04b236d523d1e0de13d2ef585223.1711993956.git.reinette.chatre@intel.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?RGdnclVzcjZ0c0w3STd4d2VjVVZNREJrTXdpSzg3R1hsYnZlTFR1OUUyem9F?=
 =?utf-8?B?S2hSU0MvZHhqTVVuWmZSYmZ0Z2JqditIaUpEdStTN1BwZ3lpalM3TGhXN1RS?=
 =?utf-8?B?TGJmZ1AwUWV6cDNid3RDMkx2dXYvRlFYODBueWRvZy9BYVRWTndnM2RYR2Rk?=
 =?utf-8?B?OTdQWE1JTjg5dDdLMDF1ejBYN2x5cFFEVzhMMEswRENZbXJVOEtGc29BTjhQ?=
 =?utf-8?B?UUFidUNjaFhpNE5EQXBkUEFjR0Fpd0lrblJnTXl4M1lJUmZDREw5b2RXdjIw?=
 =?utf-8?B?aFhkZEFvaklxZGlMdXRmQm1WYUJHZVZ3NUVrSnNIaVpUbG9rdE4yMjNjNW9S?=
 =?utf-8?B?SFo0SlJFY1VWT0luZEFMdG9wSXR4UjFncFEvY1hWZ0x4TWRKUDhnUWdVN2lq?=
 =?utf-8?B?NWdkOGM5Q2tQVEhNdFo0bkhLNTc1bWJoeWpQbHg4engxSkRyUVdEaFExY0x5?=
 =?utf-8?B?Zy8rNFpsdEdyNEs3WFZkOXgxY0NsNWp6dW13eFlPb2NDTzF5QjlJY0hmSWNL?=
 =?utf-8?B?YXN2MWJlUm43UjRieUhSTGdCekJ6a0pHRFpOdy80NW9zaUZ2Mlp3a24wdVht?=
 =?utf-8?B?dzc3UlRNU3VrTmlJS05hNXpqS2h4MEkzVzA1UVV1RWdBWlFYMC9JSW5xdnNQ?=
 =?utf-8?B?NUtKeitVcTNtL0VtT1FidThzRkx4Z0kwZnZLRk0yRjhBekdreDQ3eW1XOHJL?=
 =?utf-8?B?cENudlJVd3R5bmN3WFpHUmx3djAxS3M5eXh1MHBoOTIwSmV0c3FSZWY4eFcw?=
 =?utf-8?B?OGhkYzJYZWlTaXVaL0h2a2lVZzR0YlB3OXB2aEJaKzVJNnJrbno1UDZHbUY3?=
 =?utf-8?B?d3R4Szc1eFlTaWF2ODNvWTNhZXFiMUJKaUtpRUZ5MTFNV3ZWYlAwQmpReDg0?=
 =?utf-8?B?TTZORVFZOEdoMDNiSXFpbm8rTjBsbjE3NUc3QWVQUDFmQTZvblU2RWRIcjEw?=
 =?utf-8?B?MktURm83T2p4MEZCc1pEK0VuclpiZ0kya2JMTSt0SC8vSGNOT0U0UWVPWmJG?=
 =?utf-8?B?VGFpa253V1ZQem1KWmpYZHVHVFd6REgxbkc2bDZWT004aURtVXVTNkxTOWVy?=
 =?utf-8?B?N1h5eHdFaWVrUGxyZjdxaHVma0I0cGEzYVdFM3V2VVQzWHVyTkVMR01kVDJX?=
 =?utf-8?B?Z3YvWTJJKzZiY3IzWHRycTF5Q3Jvc0ZJMVJQNnVnY0pqczN4RXgyMCt4NUxo?=
 =?utf-8?B?N1pLbUEvdzJSSGZFWE93TWlQUlBuTnJEdEtySnVrS2F3andaNFdoU1o2Z080?=
 =?utf-8?B?SjE5eWxQdVVhb1dKTnFGTDRTa1c4Q1ZOUjc5UURQL29CcjIvMVFEeWhZaEdL?=
 =?utf-8?B?c3JFM0RybTF3MHhCV2F3dWtWb2NYY3hpUUVxRSsrN3gzWGQ2OGk1bS9jQXgw?=
 =?utf-8?B?QXY0aHdGTERxbFA3Uktia2RNTVcyb2VSODRyYXhtZ1I2VHpYSVdEYWhRK2kv?=
 =?utf-8?B?bVpTb0E3WWJURnROZStQNjdieEpPU3FMNDcwajZJY1UxVjVUOXZXM3o5bVJs?=
 =?utf-8?B?RkF0UjF3S0ptZXoybWxvRmpXK1JzM2N4SjlqZTZRTzNlS0FyT2R0SVNyTVZi?=
 =?utf-8?B?SjVCSEZldm40UDVhSFZGK0lEQmU4MFFzamc1aVplZEVOWFJPaEFBNDNmbVVv?=
 =?utf-8?B?dEVUeHN1ZGNld1JocWxwa3Axb1JoRGkrZ3FGODhJUEZNdnk4cUJXM05WRlg0?=
 =?utf-8?B?Uy83b2lCcURKYmdoRXJXdEN0dUREOC9IRit0eXkwQzJONlRkckx0WTUwLzlX?=
 =?utf-8?B?Wll4bzV0TUh0TmZEMFBWZWRuS3VDY2VMeWlZVjk3SG5RQWhYQitMZkR4SnBz?=
 =?utf-8?B?NXhYeS91dEQ3NUEvbVZBZmc5M2c1UC9aYU00ZmI1QmVETXBVeCtmOXBMd29I?=
 =?utf-8?B?OFZza1d4a2x5cUJtVzZsYXROSjgremFQd3MxOThpRHFUbE0vZHNSNjMzZVdT?=
 =?utf-8?B?Q09EdXNrY29CLzZpaXgyVFY4dUx2bEVQZ0I4UmRXWTYzVWpiL2tKZ1BmK3ZB?=
 =?utf-8?B?OGo0aHFTdytwNFhsVEZnMVlmeTRkOEI4K1JsODBRcVFRbTVBSEhyYVhna2lv?=
 =?utf-8?B?WEowZHNSVE9jeDhGdWJQMlYyOVdPYnJjZit5a2U4VHVkNU1Fcjk4ekQ3Yzlo?=
 =?utf-8?Q?TyvA=3D?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f771730f-a602-4fc4-390f-08dc528082d7
X-MS-Exchange-CrossTenant-AuthSource: MW3PR12MB4553.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Apr 2024 19:18:28.5018
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: +1FyYCanwjiyWKKUskNlCvKDVka/GCM8bO9FoUKiUYLk+xh5CastO4qQ2TlhoC0E
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR12MB9019


On 4/1/24 13:16, Reinette Chatre wrote:
> Tony encountered the OOPS below when the last CPU of a domain goes
> offline while running a kernel built with CONFIG_NO_HZ_FULL:
> 
>     BUG: kernel NULL pointer dereference, address: 0000000000000000
>     #PF: supervisor read access in kernel mode
>     #PF: error_code(0x0000) - not-present page
>     PGD 0
>     Oops: 0000 [#1] PREEMPT SMP NOPTI
>     ...
>     RIP: 0010:__find_nth_andnot_bit+0x66/0x110
>     ...
>     Call Trace:
>      <TASK>
>      ? __die+0x1f/0x60
>      ? page_fault_oops+0x176/0x5a0
>      ? exc_page_fault+0x7f/0x260
>      ? asm_exc_page_fault+0x22/0x30
>      ? __pfx_resctrl_arch_offline_cpu+0x10/0x10
>      ? __find_nth_andnot_bit+0x66/0x110
>      ? __cancel_work+0x7d/0xc0
>      cpumask_any_housekeeping+0x55/0x110
>      mbm_setup_overflow_handler+0x40/0x70
>      resctrl_offline_cpu+0x101/0x110
>      resctrl_arch_offline_cpu+0x19/0x260
>      cpuhp_invoke_callback+0x156/0x6b0
>      ? cpuhp_thread_fun+0x5f/0x250
>      cpuhp_thread_fun+0x1ca/0x250
>      ? __pfx_smpboot_thread_fn+0x10/0x10
>      smpboot_thread_fn+0x184/0x220
>      kthread+0xe0/0x110
>      ? __pfx_kthread+0x10/0x10
>      ret_from_fork+0x2d/0x50
>      ? __pfx_kthread+0x10/0x10
>      ret_from_fork_asm+0x1a/0x30
>      </TASK>
> 
> The NULL pointer dereference is encountered while searching for another
> online CPU in the domain (of which there are none) that can be used to
> run the MBM overflow handler.
> 
> Because the kernel is configured with CONFIG_NO_HZ_FULL the search for
> another CPU (in its effort to prefer those CPUs that aren't marked
> nohz_full) consults the mask representing the nohz_full CPUs,
> tick_nohz_full_mask. On a kernel with CONFIG_CPUMASK_OFFSTACK=y
> tick_nohz_full_mask is not allocated unless the kernel is booted with
> the "nohz_full=" parameter and because of that any access to
> tick_nohz_full_mask needs to be guarded with tick_nohz_full_enabled().
> 
> Replace the IS_ENABLED(CONFIG_NO_HZ_FULL) with tick_nohz_full_enabled().
> The latter ensures tick_nohz_full_mask can be accessed safely and can be
> used whether kernel is built with CONFIG_NO_HZ_FULL enabled or not.
> 
> Fixes: a4846aaf3945 ("x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow")
> Reported-by: Tony Luck <tony.luck@intel.com>
> Closes: https://lore.kernel.org/lkml/ZgIFT5gZgIQ9A9G7@agluck-desk3/
> Suggested-by: Ingo Molnar <mingo@kernel.org>
> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>

Reviewed-by: Babu Moger <babu.moger@amd.com>


-- 
Thanks
Babu Moger