Hi Greg,
-----Original Message----- From: Greg Kroah-Hartman gregkh@linuxfoundation.org Sent: Thursday, July 10, 2025 10:36 PM To: iwamatsu nobuhiro(岩松 信洋 □ＤＩＴＣ○ＣＰＴ) nobuhiro1.iwamatsu@toshiba.co.jp Cc: stable@vger.kernel.org; Sasha Levin sashal@kernel.org; Seiji Nishikawa snishika@redhat.com; Rafael J . Wysocki rafael.j.wysocki@intel.com Subject: Re: [PATCH for 5.4 and 5.10] ACPI: PAD: fix crash in exit_round_robin()
On Wed, Jun 25, 2025 at 08:56:14AM +0900, Nobuhiro Iwamatsu wrote:
From: Seiji Nishikawa snishika@redhat.com
commit 0a2ed70a549e61c5181bad5db418d223b68ae932 upstream.
The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with nr set to 0xffffffff, the address calculation may cause misalignment within the memory, leading to access to an invalid memory
address.
BUG: unable to handle kernel paging request at ffffffffe0740618 ... CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G
OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1
...RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad] Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31 RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202 RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e FS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? acpi_pad_add+0x120/0x120 [acpi_pad] kthread+0x10b/0x130 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x1f/0x40 ... CR2: ffffffffe0740618
crash> dis -lr ffffffffc0726923 ...
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_ 64/./include/linux/cpumask.h: 114
0xffffffffc0726918 <power_saving_thread+776>:
mov %r12d,%r12d
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_ 64/./include/linux/cpumask.h: 325
0xffffffffc072691b <power_saving_thread+779>: mov
-0x3f8d7de0(,%r12,4),%eax
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_ 64/./arch/x86/include/asm/bitops.h: 80
0xffffffffc0726923 <power_saving_thread+787>: lock
btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 <pad_busy_cpus_bits>
crash> px tsk_in_cpu[14] $66 = 0xffffffff
crash> px 0xffffffffc072692c+0x19cf4 $99 = 0xffffffffc0740620
crash> sym 0xffffffffc0740620 ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]
crash> px pad_busy_cpus_bits[0] $42 = 0xfffc0
To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_cpu() in exit_round_robin(), just as it is done in round_robin_cpu().
Signed-off-by: Seiji Nishikawa snishika@redhat.com Link: https://patch.msgid.link/20240825141352.25280-1-snishika@redhat.com [ rjw: Subject edit, avoid updates to the same value ] Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Link: https://nvd.nist.gov/vuln/detail/CVE-2024-49935
Why did you add a nist.gov link here?
I have added a link tag to add backport CVE infomation.
NIST is know to "enhance" cve.org reports in ways that are flat out wrong. Never trust them, only rely on the original cve.org report please, as that is under our control.
Also NIST totally ignores numerous parts of the cve.org report that we provide, making this type of link contain less information overall than the original report.
And finally, no need to add links like this to backports. If we were to do that everywhere, it would be a total mess given our rate of 13 CVEs a day we are currently running at.
Thanks for the explanation. I understand it. I will resend the patch with the link tag removed. I will also not to add unnecessary tags form next patch.
thanks,
greg k-h
Best regards, Nobuhiro