Received-SPF: pass (google.com: domain of linux-kernel+bounces-210189-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Adrian Huang <adrianhuang0701@gmail.com>
To: Joerg Roedel <joro@8bytes.org>,
	Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>,
	Will Deacon <will@kernel.org>
Cc: Dimitri Sivanich <sivanich@hpe.com>,
	iommu@lists.linux.dev,
	linux-kernel@vger.kernel.org,
	Adrian Huang <ahuang12@lenovo.com>
Subject: [PATCH 1/1] iommu/amd: Fix "execute NX-protected page" when running CPU hotplug
Date: Tue, 11 Jun 2024 23:54:44 +0800
Message-Id: <20240611155444.860-1-ahuang12@lenovo.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

From: Adrian Huang <ahuang12@lenovo.com>

When running the following command (cpu hotplug test case of LTP),
the "execute NX-protected page" exception is triggered.

  # /opt/ltp/testcases/bin/cpuhotplug02.sh -c 1 -l 1

Here is the call trace:

  process 14301 (cpuhotplug_do_s) no longer affine to cpu1
  smpboot: CPU 1 is now offline
  smpboot: Booting Node 0 Processor 1 APIC 0x2
  LVT offset 0 assigned for vector 0x400
  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
  BUG: unable to handle page fault for address: ffffffffbb559170
  #PF: supervisor instruction fetch in kernel mode
  #PF: error_code(0x0011) - permissions violation
  PGD 1ae25067 P4D 1ae25067 PUD 1ae26063 PMD 134abd063 PTE 80000000
  Oops: Oops: 0011 [#1] PREEMPT SMP NOPTI
  CPU: 1 PID: 24 Comm: cpuhp/1 Kdump: loaded Not tainted 6.10.0-rc3
  Hardware name: Lenovo ThinkSystem SR665 MB/7D2WRCZ000, BIOS D8E121K-2.20 08/12/2021
  RIP: 0010:amd_iommu_enable_faulting+0x0/0x10
  Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
   cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
  RSP: 0018:ffffb4e243fafe48 EFLAGS: 00010202
  RAX: 00000000000003c0 RBX: ffff90f4baea0820 RCX: 0000000000000000
  RDX: 00000000000000ec RSI: 00000000000000c0 RDI: 0000000000000001
  RBP: 0000000000000001 R08: ffff90f4baea0848 R09: ffff90f184a90d00
  R10: ffff90f184a90ce0 R11: ffff90f1834ebaf8 R12: 00000000000000c0
  R13: ffffffffbb559170 R14: ffffffffbaa4bd00 R15: ffff90f4baea0848
  FS:  0000000000000000(0000) GS:ffff90f4bae80000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffffffffbb559170 CR3: 000000001ae20000 CR4: 0000000000350ef0
  Call Trace:
   <TASK>
   ? __die+0x20/0x70
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? page_fault_oops+0x75/0x170
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? exc_page_fault+0xaa/0x140
   ? asm_exc_page_fault+0x22/0x30
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   ? __pfx_amd_iommu_enable_faulting+0x10/0x10
   cpuhp_invoke_callback+0x2cc/0x470
   ? __pfx_blk_mq_hctx_notify_online+0x10/0x10
   ? __pfx_smpboot_thread_fn+0x10/0x10
   cpuhp_thread_fun+0x8b/0x140
   smpboot_thread_fn+0xd9/0x1d0
   kthread+0xcf/0x100
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x30/0x50
   ? __pfx_kthread+0x10/0x10
   ret_from_fork_asm+0x1a/0x30
   </TASK>

The address '0xffffffffbb559170' is the function address of
'amd_iommu_enable_faulting()'. However, this function is declared with
'__init' keyword and will be freed in free_initmem().

Fix the issue by removing '__init' keyword since this function is still
needed for the up-and-running kernel.

Fixes: d74169ceb0d2 ("iommu/vt-d: Allocate DMAR fault interrupts locally")
Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
---
 drivers/iommu/amd/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 27e293727095..161248067776 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -3362,7 +3362,7 @@ int amd_iommu_reenable(int mode)
 	return 0;
 }
 
-int __init amd_iommu_enable_faulting(unsigned int cpu)
+int amd_iommu_enable_faulting(unsigned int cpu)
 {
 	/* We enable MSI later when PCI is initialized */
 	return 0;
-- 
2.25.1