The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 94a17f2dc90bc7eae36c0f478515d4bd1c23e877
Gitweb: https://git.kernel.org/tip/94a17f2dc90bc7eae36c0f478515d4bd1c23e877
Author: Dave Hansen <dave.hansen(a)linux.intel.com>
AuthorDate: Tue, 10 Jun 2025 15:24:20 -07:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Tue, 17 Jun 2025 15:36:57 -07:00
x86/mm: Disable INVLPGB when PTI is enabled
PTI uses separate ASIDs (aka. PCIDs) for kernel and user address
spaces. When the kernel needs to flush the user address space, it
just sets a bit in a bitmap and then flushes the entire PCID on
the next switch to userspace.
This bitmap is a single 'unsigned long' which is plenty for all 6
dynamic ASIDs. But, unfortunately, the INVLPGB support brings along a
bunch more user ASIDs, as many as ~2k more. The bitmap can't address
that many.
Fortunately, the bitmap is only needed for PTI and all the CPUs
with INVLPGB are AMD CPUs that aren't vulnerable to Meltdown and
don't need PTI. The only way someone can run into an issue in
practice is by booting with pti=on on a newer AMD CPU.
Disable INVLPGB if PTI is enabled. Avoid overrunning the small
bitmap.
Note: this will be fixed up properly by making the bitmap bigger.
For now, just avoid the mostly theoretical bug.
Fixes: 4afeb0ed1753 ("x86/mm: Enable broadcast TLB invalidation for multi-threaded processes")
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Acked-by: Rik van Riel <riel(a)surriel.com>
Cc:stable@vger.kernel.org
Link: https://lore.kernel.org/all/20250610222420.E8CBF472%40davehans-spike.ostc.i…
---
arch/x86/mm/pti.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 1902998..c0c40b6 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -98,6 +98,11 @@ void __init pti_check_boottime_disable(void)
return;
setup_force_cpu_cap(X86_FEATURE_PTI);
+
+ if (cpu_feature_enabled(X86_FEATURE_INVLPGB)) {
+ pr_debug("PTI enabled, disabling INVLPGB\n");
+ setup_clear_cpu_cap(X86_FEATURE_INVLPGB);
+ }
}
static int __init pti_parse_cmdline(char *arg)
Hello,
New build issue found on stable-rc/linux-6.12.y:
---
‘lvts_debugfs_exit’ defined but not used [-Werror=unused-function] in
drivers/thermal/mediatek/lvts_thermal.o
(drivers/thermal/mediatek/lvts_thermal.c)
[logspec:kbuild,kbuild.compiler.error]
---
- dashboard: https://d.kernelci.org/i/maestro:fb8aae5340da55b6254442f0858147bf5f0b39dc
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: 519e0647630e07972733e99a0dc82065a65736ea
Log excerpt:
=====================================================
drivers/thermal/mediatek/lvts_thermal.c:262:13: error:
‘lvts_debugfs_exit’ defined but not used [-Werror=unused-function]
262 | static void lvts_debugfs_exit(struct lvts_domain *lvts_td) { }
| ^~~~~~~~~~~~~~~~~
CC [M] drivers/watchdog/softdog.o
cc1: all warnings being treated as errors
=====================================================
# Builds where the incident occurred:
## cros://chromeos-6.6/arm64/chromiumos-mediatek.flavour.config+lab-setup+arm64-chromebook+CONFIG_MODULE_COMPRESS=n+CONFIG_MODULE_COMPRESS_NONE=y
on (arm64):
- compiler: gcc-12
- dashboard: https://d.kernelci.org/build/maestro:685194ac5c2cf25042b9c1a8
#kernelci issue maestro:fb8aae5340da55b6254442f0858147bf5f0b39dc
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org
Hi Greg & Sasha !
I ran into some trouble in my nightly CI systems that test v6.6.y and
v6.1.y. Using "make binrpm-pkg" followed by "rpm -iv ..." results in the
test systems being unbootable because the vmlinuz file is never copied
to /boot. The test systems are imaged with Fedora 39.
I found a related Fedora bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2239008
It appears there is a missing fix in LTS kernels. I bisected the kernel
fix to:
358de8b4f201 ("kbuild: rpm-pkg: simplify installkernel %post")
which includes a "Cc: stable" tag but does not appear in
origin/linux-6.6.y, origin/linux-6.1.y, or origin/5.15.y (I did not look
further back than that).
Would it be appropriate to apply 358de8b4f201 to LTS kernels?
--
Chuck Lever
tianshuo han reported a remotely-triggerable crash if the client sends a
kernel RPC server a specially crafted packet. If decoding the RPC reply
fails in such a way that SVC_GARBAGE is returned without setting the
rq_accept_statp pointer, then that pointer can be dereferenced and a
value stored there.
If it's the first time the thread has processed an RPC, then that
pointer will be set to NULL and the kernel will crash. In other cases,
it could create a memory scribble.
The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate
or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531
says that if authentication fails that the RPC should be rejected
instead with a status of AUTH_ERR.
Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of
AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This
sidesteps the whole problem of touching the rpc_accept_statp pointer in
this situation and avoids the crash.
Cc: stable(a)vger.kernel.org # v6.9+
Fixes: 29cd2927fb91 ("SUNRPC: Fix encoding of accepted but unsuccessful RPC replies")
Reported-by: tianshuo han <hantianshuo233(a)gmail.com>
Signed-off-by: Jeff Layton <jlayton(a)kernel.org>
---
This should be more correct. Unfortunately, I don't know of any
testcases for low-level RPC error handling. That seems like something
that would be nice to do with pynfs or similar though.
---
Changes in v2:
- Fix endianness of rq_accept_statp assignment
- Better describe the way the crash happens and how this fixes it
- point Fixes: tag at correct patch
- add Cc: stable tag
---
net/sunrpc/svc.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 939b6239df8ab6229ce34836d77d3a6b983fbbb7..99050ab1435148ac5d52b697ab1a771b9e948143 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1375,7 +1375,8 @@ svc_process_common(struct svc_rqst *rqstp)
case SVC_OK:
break;
case SVC_GARBAGE:
- goto err_garbage_args;
+ rqstp->rq_auth_stat = rpc_autherr_badcred;
+ goto err_bad_auth;
case SVC_SYSERR:
goto err_system_err;
case SVC_DENIED:
@@ -1516,14 +1517,6 @@ svc_process_common(struct svc_rqst *rqstp)
*rqstp->rq_accept_statp = rpc_proc_unavail;
goto sendit;
-err_garbage_args:
- svc_printk(rqstp, "failed to decode RPC header\n");
-
- if (serv->sv_stats)
- serv->sv_stats->rpcbadfmt++;
- *rqstp->rq_accept_statp = rpc_garbage_args;
- goto sendit;
-
err_system_err:
if (serv->sv_stats)
serv->sv_stats->rpcbadfmt++;
---
base-commit: 9afe652958c3ee88f24df1e4a97f298afce89407
change-id: 20250617-rpc-6-16-cc7a23e9c961
Best regards,
--
Jeff Layton <jlayton(a)kernel.org>
Hello,
New build issue found on stable-rc/linux-5.4.y:
---
clang: error: assembler command failed with exit code 1 (use -v to
see invocation) in drivers/firmware/qcom_scm-32.o
(scripts/Makefile.build:262) [logspec:kbuild,kbuild.compiler.error]
---
- dashboard: https://d.kernelci.org/i/maestro:e1ce6e2cb61e68ec7bf14991570487d713f77e0a
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: e2f5a2e75b315706dd2d1d50a4313e5785eb189d
Log excerpt:
=====================================================
CC drivers/firmware/qcom_scm-32.o
CC lib/idr.o
CC drivers/gpu/host1x/debug.o
CC drivers/clk/rockchip/clk-rk3328.o
CC drivers/clk/rockchip/clk-rk3368.o
CC lib/ioremap.o
CC drivers/gpu/drm/drm_probe_helper.o
CC drivers/clk/rockchip/clk-rk3399.o
/tmp/qcom_scm-32-2d4d72.s: Assembler messages:
/tmp/qcom_scm-32-2d4d72.s:56: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:69: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:173: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:394: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:545: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:930: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:1070: Error: selected processor does not
support `smc #0' in ARM mode
/tmp/qcom_scm-32-2d4d72.s:1117: Error: selected processor does not
support `smc #0' in ARM mode
clang: error: assembler command failed with exit code 1 (use -v to see
invocation)
=====================================================
# Builds where the incident occurred:
## defconfig+allmodconfig+CONFIG_FRAME_WARN=2048 on (arm):
- compiler: clang-17
- dashboard: https://d.kernelci.org/build/maestro:685191885c2cf25042b9bb39
## multi_v7_defconfig on (arm):
- compiler: clang-17
- dashboard: https://d.kernelci.org/build/maestro:685191845c2cf25042b9bb35
#kernelci issue maestro:e1ce6e2cb61e68ec7bf14991570487d713f77e0a
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org
Hello,
New build issue found on stable-rc/linux-6.1.y:
---
stack frame size (2488) exceeds limit (2048) in
'dml31_ModeSupportAndSystemConfigurationFull'
[-Werror,-Wframe-larger-than] in
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.o
(drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.c)
[logspec:kbuild,kbuild.compiler.error]
---
- dashboard: https://d.kernelci.org/i/maestro:69fb66ef80a96ff4750a9dacf73be24a7cbe888e
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: 2c86adab41e98d103953bf8c447202c9147150ab
Log excerpt:
=====================================================
drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.c:3795:6:
error: stack frame size (2488) exceeds limit (2048) in
'dml31_ModeSupportAndSystemConfigurationFull'
[-Werror,-Wframe-larger-than]
3795 | void dml31_ModeSupportAndSystemConfigurationFull(struct
display_mode_lib *mode_lib)
| ^
CC drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn303/dcn303_fpu.o
1 error generated.
CC drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn314/dcn314_fpu.o
=====================================================
# Builds where the incident occurred:
## x86_64_defconfig+kselftest+x86-board on (x86_64):
- compiler: clang-17
- dashboard: https://d.kernelci.org/build/maestro:685193725c2cf25042b9bcc9
#kernelci issue maestro:69fb66ef80a96ff4750a9dacf73be24a7cbe888e
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org
Hello,
New build issue found on stable-rc/linux-5.4.y:
---
in drivers/firmware/qcom_scm-32.o (scripts/Makefile.build:262)
[logspec:kbuild,kbuild.compiler]
---
- dashboard: https://d.kernelci.org/i/maestro:04c1ce2921a16b59c7329a6026c59ea7942ef691
- giturl: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
- commit HEAD: e2f5a2e75b315706dd2d1d50a4313e5785eb189d
Log excerpt:
=====================================================
CC drivers/firmware/qcom_scm-32.o
CC drivers/firmware/trusted_foundations.o
CC drivers/clk/qcom/clk-regmap.o
CC drivers/gpio/gpio-pl061.o
CC kernel/resource.o
CC kernel/sysctl.o
/tmp/ccsKkK07.s: Assembler messages:
/tmp/ccsKkK07.s:45: Error: selected processor does not support `smc
#0' in ARM mode
/tmp/ccsKkK07.s:94: Error: selected processor does not support `smc
#0' in ARM mode
/tmp/ccsKkK07.s:160: Error: selected processor does not support `smc
#0' in ARM mode
/tmp/ccsKkK07.s:296: Error: selected processor does not support `smc
#0' in ARM mode
=====================================================
# Builds where the incident occurred:
## multi_v7_defconfig on (arm):
- compiler: gcc-12
- dashboard: https://d.kernelci.org/build/maestro:685191a35c2cf25042b9bb4f
## multi_v7_defconfig+kselftest on (arm):
- compiler: gcc-12
- dashboard: https://d.kernelci.org/build/maestro:685191ab5c2cf25042b9bb56
#kernelci issue maestro:04c1ce2921a16b59c7329a6026c59ea7942ef691
Reported-by: kernelci.org bot <bot(a)kernelci.org>
--
This is an experimental report format. Please send feedback in!
Talk to us at kernelci(a)lists.linux.dev
Made with love by the KernelCI team - https://kernelci.org