mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
x86/fpu: Correct pkru/xstate inconsistency
When eagerly switching PKRU in switch_fpu_finish() it checks that current is not a kernel thread as kernel threads will never use PKRU. It's possible that this_cpu_read_stable() on current_task (ie. get_current()) is returning an old cached value. To resolve this reference next_p directly rather than relying on current. As written it's possible when switching from a kernel thread to a userspace thread to observe a cached PF_KTHREAD flag and never restore the PKRU. And as a result this issue only occurs when switching from a kernel thread to a userspace thread, switching from a non kernel thread works perfectly fine because all that is considered in that situation are the flags from some other non kernel task and the next fpu is passed in to switch_fpu_finish(). This behavior only exists between 5.2 and 5.13 when it was fixed by a rewrite decoupling PKRU from xstate, in: commit954436989c
("x86/fpu: Remove PKRU handling from switch_fpu_finish()") Unfortunately backporting the fix from 5.13 is probably not realistic as it's part of a 60+ patch series which rewrites most of the PKRU handling. Fixes:0cecca9d03
("x86/fpu: Eager switch PKRU state") Signed-off-by: Brian Geffon <bgeffon@google.com> Signed-off-by: Willis Kung <williskung@google.com> Tested-by: Willis Kung <williskung@google.com> Cc: <stable@vger.kernel.org> # v5.4.x Cc: <stable@vger.kernel.org> # v5.10.x Acked-by: Dave Hansen <dave.hansen@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
68f19845f5
commit
bae7fc6f0d
3 changed files with 12 additions and 13 deletions
|
@ -531,9 +531,11 @@ static inline void __fpregs_load_activate(void)
|
|||
* The FPU context is only stored/restored for a user task and
|
||||
* PF_KTHREAD is used to distinguish between kernel and user threads.
|
||||
*/
|
||||
static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu)
|
||||
static inline void switch_fpu_prepare(struct task_struct *prev, int cpu)
|
||||
{
|
||||
if (static_cpu_has(X86_FEATURE_FPU) && !(current->flags & PF_KTHREAD)) {
|
||||
struct fpu *old_fpu = &prev->thread.fpu;
|
||||
|
||||
if (static_cpu_has(X86_FEATURE_FPU) && !(prev->flags & PF_KTHREAD)) {
|
||||
if (!copy_fpregs_to_fpstate(old_fpu))
|
||||
old_fpu->last_cpu = -1;
|
||||
else
|
||||
|
@ -552,10 +554,11 @@ static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu)
|
|||
* Load PKRU from the FPU context if available. Delay loading of the
|
||||
* complete FPU state until the return to userland.
|
||||
*/
|
||||
static inline void switch_fpu_finish(struct fpu *new_fpu)
|
||||
static inline void switch_fpu_finish(struct task_struct *next)
|
||||
{
|
||||
u32 pkru_val = init_pkru_value;
|
||||
struct pkru_state *pk;
|
||||
struct fpu *next_fpu = &next->thread.fpu;
|
||||
|
||||
if (!static_cpu_has(X86_FEATURE_FPU))
|
||||
return;
|
||||
|
@ -569,7 +572,7 @@ static inline void switch_fpu_finish(struct fpu *new_fpu)
|
|||
* PKRU state is switched eagerly because it needs to be valid before we
|
||||
* return to userland e.g. for a copy_to_user() operation.
|
||||
*/
|
||||
if (!(current->flags & PF_KTHREAD)) {
|
||||
if (!(next->flags & PF_KTHREAD)) {
|
||||
/*
|
||||
* If the PKRU bit in xsave.header.xfeatures is not set,
|
||||
* then the PKRU component was in init state, which means
|
||||
|
@ -578,7 +581,7 @@ static inline void switch_fpu_finish(struct fpu *new_fpu)
|
|||
* in memory is not valid. This means pkru_val has to be
|
||||
* set to 0 and not to init_pkru_value.
|
||||
*/
|
||||
pk = get_xsave_addr(&new_fpu->state.xsave, XFEATURE_PKRU);
|
||||
pk = get_xsave_addr(&next_fpu->state.xsave, XFEATURE_PKRU);
|
||||
pkru_val = pk ? pk->pkru : 0;
|
||||
}
|
||||
__write_pkru(pkru_val);
|
||||
|
|
|
@ -159,14 +159,12 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|||
{
|
||||
struct thread_struct *prev = &prev_p->thread,
|
||||
*next = &next_p->thread;
|
||||
struct fpu *prev_fpu = &prev->fpu;
|
||||
struct fpu *next_fpu = &next->fpu;
|
||||
int cpu = smp_processor_id();
|
||||
|
||||
/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
|
||||
|
||||
if (!test_thread_flag(TIF_NEED_FPU_LOAD))
|
||||
switch_fpu_prepare(prev_fpu, cpu);
|
||||
switch_fpu_prepare(prev_p, cpu);
|
||||
|
||||
/*
|
||||
* Save away %gs. No need to save %fs, as it was saved on the
|
||||
|
@ -213,7 +211,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|||
|
||||
this_cpu_write(current_task, next_p);
|
||||
|
||||
switch_fpu_finish(next_fpu);
|
||||
switch_fpu_finish(next_p);
|
||||
|
||||
/* Load the Intel cache allocation PQR MSR. */
|
||||
resctrl_sched_in();
|
||||
|
|
|
@ -535,15 +535,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|||
{
|
||||
struct thread_struct *prev = &prev_p->thread;
|
||||
struct thread_struct *next = &next_p->thread;
|
||||
struct fpu *prev_fpu = &prev->fpu;
|
||||
struct fpu *next_fpu = &next->fpu;
|
||||
int cpu = smp_processor_id();
|
||||
|
||||
WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&
|
||||
this_cpu_read(irq_count) != -1);
|
||||
|
||||
if (!test_thread_flag(TIF_NEED_FPU_LOAD))
|
||||
switch_fpu_prepare(prev_fpu, cpu);
|
||||
switch_fpu_prepare(prev_p, cpu);
|
||||
|
||||
/* We must save %fs and %gs before load_TLS() because
|
||||
* %fs and %gs may be cleared by load_TLS().
|
||||
|
@ -595,7 +593,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|||
this_cpu_write(current_task, next_p);
|
||||
this_cpu_write(cpu_current_top_of_stack, task_top_of_stack(next_p));
|
||||
|
||||
switch_fpu_finish(next_fpu);
|
||||
switch_fpu_finish(next_p);
|
||||
|
||||
/* Reload sp0. */
|
||||
update_task_stack(next_p);
|
||||
|
|
Loading…
Reference in a new issue