提交 de90add3 编写于 作者: M Markus Metzger 提交者: Ingo Molnar

x86, bts: fix wrmsr and spinlock over kmalloc

Impact: fix sleeping-with-spinlock-held bugs/crashes

- Turn a wrmsr to write the DS_AREA MSR into a wrmsrl.
- Use irqsave variants of spinlocks.
- Do not allocate memory while holding spinlocks.
Reported-by: NStephane Eranian <eranian@googlemail.com>
Reported-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NMarkus Metzger <markus.t.metzger@intel.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>
上级 c4858ffc
...@@ -209,14 +209,15 @@ static DEFINE_PER_CPU(struct ds_context *, system_context); ...@@ -209,14 +209,15 @@ static DEFINE_PER_CPU(struct ds_context *, system_context);
static inline struct ds_context *ds_get_context(struct task_struct *task) static inline struct ds_context *ds_get_context(struct task_struct *task)
{ {
struct ds_context *context; struct ds_context *context;
unsigned long irq;
spin_lock(&ds_lock); spin_lock_irqsave(&ds_lock, irq);
context = (task ? task->thread.ds_ctx : this_system_context); context = (task ? task->thread.ds_ctx : this_system_context);
if (context) if (context)
context->count++; context->count++;
spin_unlock(&ds_lock); spin_unlock_irqrestore(&ds_lock, irq);
return context; return context;
} }
...@@ -224,55 +225,46 @@ static inline struct ds_context *ds_get_context(struct task_struct *task) ...@@ -224,55 +225,46 @@ static inline struct ds_context *ds_get_context(struct task_struct *task)
/* /*
* Same as ds_get_context, but allocates the context and it's DS * Same as ds_get_context, but allocates the context and it's DS
* structure, if necessary; returns NULL; if out of memory. * structure, if necessary; returns NULL; if out of memory.
*
* pre: requires ds_lock to be held
*/ */
static inline struct ds_context *ds_alloc_context(struct task_struct *task) static inline struct ds_context *ds_alloc_context(struct task_struct *task)
{ {
struct ds_context **p_context = struct ds_context **p_context =
(task ? &task->thread.ds_ctx : &this_system_context); (task ? &task->thread.ds_ctx : &this_system_context);
struct ds_context *context = *p_context; struct ds_context *context = *p_context;
unsigned long irq;
if (!context) { if (!context) {
spin_unlock(&ds_lock);
context = kzalloc(sizeof(*context), GFP_KERNEL); context = kzalloc(sizeof(*context), GFP_KERNEL);
if (!context)
if (!context) {
spin_lock(&ds_lock);
return NULL; return NULL;
}
context->ds = kzalloc(ds_cfg.sizeof_ds, GFP_KERNEL); context->ds = kzalloc(ds_cfg.sizeof_ds, GFP_KERNEL);
if (!context->ds) { if (!context->ds) {
kfree(context); kfree(context);
spin_lock(&ds_lock);
return NULL; return NULL;
} }
spin_lock(&ds_lock); spin_lock_irqsave(&ds_lock, irq);
/*
* Check for race - another CPU could have allocated
* it meanwhile:
*/
if (*p_context) { if (*p_context) {
kfree(context->ds); kfree(context->ds);
kfree(context); kfree(context);
return *p_context;
}
*p_context = context;
context->this = p_context; context = *p_context;
context->task = task; } else {
*p_context = context;
if (task) context->this = p_context;
set_tsk_thread_flag(task, TIF_DS_AREA_MSR); context->task = task;
if (!task || (task == current)) if (task)
wrmsr(MSR_IA32_DS_AREA, (unsigned long)context->ds, 0); set_tsk_thread_flag(task, TIF_DS_AREA_MSR);
get_tracer(task); if (!task || (task == current))
wrmsrl(MSR_IA32_DS_AREA,
(unsigned long)context->ds);
}
spin_unlock_irqrestore(&ds_lock, irq);
} }
context->count++; context->count++;
...@@ -286,10 +278,12 @@ static inline struct ds_context *ds_alloc_context(struct task_struct *task) ...@@ -286,10 +278,12 @@ static inline struct ds_context *ds_alloc_context(struct task_struct *task)
*/ */
static inline void ds_put_context(struct ds_context *context) static inline void ds_put_context(struct ds_context *context)
{ {
unsigned long irq;
if (!context) if (!context)
return; return;
spin_lock(&ds_lock); spin_lock_irqsave(&ds_lock, irq);
if (--context->count) if (--context->count)
goto out; goto out;
...@@ -311,7 +305,7 @@ static inline void ds_put_context(struct ds_context *context) ...@@ -311,7 +305,7 @@ static inline void ds_put_context(struct ds_context *context)
kfree(context->ds); kfree(context->ds);
kfree(context); kfree(context);
out: out:
spin_unlock(&ds_lock); spin_unlock_irqrestore(&ds_lock, irq);
} }
...@@ -382,6 +376,7 @@ static int ds_request(struct task_struct *task, void *base, size_t size, ...@@ -382,6 +376,7 @@ static int ds_request(struct task_struct *task, void *base, size_t size,
struct ds_context *context; struct ds_context *context;
unsigned long buffer, adj; unsigned long buffer, adj;
const unsigned long alignment = (1 << 3); const unsigned long alignment = (1 << 3);
unsigned long irq;
int error = 0; int error = 0;
if (!ds_cfg.sizeof_ds) if (!ds_cfg.sizeof_ds)
...@@ -396,26 +391,27 @@ static int ds_request(struct task_struct *task, void *base, size_t size, ...@@ -396,26 +391,27 @@ static int ds_request(struct task_struct *task, void *base, size_t size,
return -EOPNOTSUPP; return -EOPNOTSUPP;
spin_lock(&ds_lock);
error = -ENOMEM;
context = ds_alloc_context(task); context = ds_alloc_context(task);
if (!context) if (!context)
goto out_unlock; return -ENOMEM;
spin_lock_irqsave(&ds_lock, irq);
error = -EPERM; error = -EPERM;
if (!check_tracer(task)) if (!check_tracer(task))
goto out_unlock; goto out_unlock;
get_tracer(task);
error = -EALREADY; error = -EALREADY;
if (context->owner[qual] == current) if (context->owner[qual] == current)
goto out_unlock; goto out_put_tracer;
error = -EPERM; error = -EPERM;
if (context->owner[qual] != NULL) if (context->owner[qual] != NULL)
goto out_unlock; goto out_put_tracer;
context->owner[qual] = current; context->owner[qual] = current;
spin_unlock(&ds_lock); spin_unlock_irqrestore(&ds_lock, irq);
error = -ENOMEM; error = -ENOMEM;
...@@ -463,10 +459,17 @@ static int ds_request(struct task_struct *task, void *base, size_t size, ...@@ -463,10 +459,17 @@ static int ds_request(struct task_struct *task, void *base, size_t size,
out_release: out_release:
context->owner[qual] = NULL; context->owner[qual] = NULL;
ds_put_context(context); ds_put_context(context);
put_tracer(task);
return error;
out_put_tracer:
spin_unlock_irqrestore(&ds_lock, irq);
ds_put_context(context);
put_tracer(task);
return error; return error;
out_unlock: out_unlock:
spin_unlock(&ds_lock); spin_unlock_irqrestore(&ds_lock, irq);
ds_put_context(context); ds_put_context(context);
return error; return error;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册