github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

- Prevent OOB access in the resctrl code while offlining

Browse Source 
CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
    (Reinette Chatre)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKEsURHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gcWhAApp+w5vUx0FXlou1Mzvn63bXey9/CMXyX
 rrUeWA+ic7PpNvImuwixdyPyS1CnF2l7lMcmOtiNE4wnRvCf+0rsrwgYy4m4qd/2
 aLAftFDp9WhKKH3Bb6gnVfMXiXmYb4eCQO0pRhJY26QtVJ2RGkbenW/TdTnAAAwS
 KO8bJGsllufiF0+k4G5YMgiVcgZFByn/nuqmzvIc+oKQt5LSMvkKijoM7ozX9q5g
 c1ABWvag3KWU2gFI00GfvzuQ7n7ckGhBVRwtO9DMox68liOlKOHedEFF0A0+KiDt
 fk6b2LFbqm6hB7TpWRQqQ+rPusbDdAVxKG8ehIkjR8BD49VwzZUcr5kiWS5/xplm
 a9F7cJpAJiuSiTi2HYtQVOlrCujonmjt11qqj3cCCjkton+IC9twhDkrj6+Kxygq
 W3oc8Gia2JWoFBNt/6l0iKRJjluqgPJ8crPHpnDr4C5KEnsEIqCQsSPsVjoYM5mY
 +xwS9jMJM7Dhrw3OZ6b5D8jY9oonBM/BB+jMomQ9ncDijUwKybgqp0JXB/3ydIw3
 ci69tewFdVD+9EyNAz+dqANuhNyF1JTFza/5QxAU88E1wp2O2WjahSPvkNU/ekNK
 jDGLf8VyiI08bH2pyYIhEhcvmTZ5Ocyuj9zA4Ufi2V3gaDMkvMXRipxm50dAhaWG
 CMoZ+wTnI/8=
 =mae/
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Ingo Molnar:

 - Prevent OOB access in the resctrl code while offlining
   CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
   (Reinette Chatre)

* tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
This commit is contained in:
Linus Torvalds 2026-07-05 05:37:46 -10:00
commit f105f3631d
2 changed files with 26 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
arch/x86/kernel/cpu/resctrl/monitor.c
View File

@ -259,6 +259,11 @@ int resctrl_arch_rmid_read(struct rdt_resource *r, struct rdt_domain_hdr *hdr,
if (!domain_header_is_valid(hdr, RESCTRL_MON_DOMAIN, RDT_RESOURCE_L3))
return -EINVAL;
if (cpumask_empty(&hdr->cpu_mask)) {
pr_warn_once("Domain %d has no CPUs\n", hdr->id);
return -EINVAL;
}
d = container_of(hdr, struct rdt_l3_mon_domain, hdr);
hw_dom = resctrl_to_arch_mon_dom(d);
cpu = cpumask_any(&hdr->cpu_mask);

37
fs/resctrl/monitor.c
View File

@ -135,10 +135,10 @@ void __check_limbo(struct rdt_l3_mon_domain *d, bool force_free)
struct rdt_resource *r = resctrl_arch_get_resource(RDT_RESOURCE_L3);
u32 idx_limit = resctrl_arch_system_num_rmid_idx();
struct rmid_entry *entry;
bool rmid_dirty = true;
u32 idx, cur_idx = 1;
void *arch_mon_ctx;
void *arch_priv;
bool rmid_dirty;
u64 val = 0;
arch_priv = mon_event_all[QOS_L3_OCCUP_EVENT_ID].arch_priv;
@ -161,22 +161,27 @@ void __check_limbo(struct rdt_l3_mon_domain *d, bool force_free)
break;
entry = __rmid_entry(idx);
if (resctrl_arch_rmid_read(r, &d->hdr, entry->closid, entry->rmid,
QOS_L3_OCCUP_EVENT_ID, arch_priv, &val,
arch_mon_ctx)) {
rmid_dirty = true;
} else {
rmid_dirty = (val >= resctrl_rmid_realloc_threshold);
if (!force_free) {
if (resctrl_arch_rmid_read(r, &d->hdr, entry->closid,
entry->rmid, QOS_L3_OCCUP_EVENT_ID,
arch_priv, &val, arch_mon_ctx)) {
rmid_dirty = true;
} else {
rmid_dirty = (val >= resctrl_rmid_realloc_threshold);
/*
* x86's CLOSID and RMID are independent numbers, so the entry's
* CLOSID is an empty CLOSID (X86_RESCTRL_EMPTY_CLOSID). On Arm the
* RMID (PMG) extends the CLOSID (PARTID) space with bits that aren't
* used to select the configuration. It is thus necessary to track both
* CLOSID and RMID because there may be dependencies between them
* on some architectures.
*/
trace_mon_llc_occupancy_limbo(entry->closid, entry->rmid, d->hdr.id, val);
/*
* x86's CLOSID and RMID are independent numbers,
* so the entry's CLOSID is an empty CLOSID
* (X86_RESCTRL_EMPTY_CLOSID). On Arm the RMID
* (PMG) extends the CLOSID (PARTID) space with
* bits that aren't used to select the configuration.
* It is thus necessary to track both CLOSID and
* RMID because there may be dependencies between
* them on some architectures.
*/
trace_mon_llc_occupancy_limbo(entry->closid, entry->rmid,
d->hdr.id, val);
}
}
if (force_free || !rmid_dirty) {