releases/4.15.10/x86-mce-serialize-sysfs-changes.patch

   1 From b3b7c4795ccab5be71f080774c45bbbcc75c2aaf Mon Sep 17 00:00:00 2001
   2 From: Seunghun Han <kkamagui@gmail.com>
   3 Date: Tue, 6 Mar 2018 15:21:43 +0100
   4 Subject: x86/MCE: Serialize sysfs changes
   5
   6 From: Seunghun Han <kkamagui@gmail.com>
   7
   8 commit b3b7c4795ccab5be71f080774c45bbbcc75c2aaf upstream.
   9
  10 The check_interval file in
  11
  12   /sys/devices/system/machinecheck/machinecheck<cpu number>
  13
  14 directory is a global timer value for MCE polling. If it is changed by one
  15 CPU, mce_restart() broadcasts the event to other CPUs to delete and restart
  16 the MCE polling timer and __mcheck_cpu_init_timer() reinitializes the
  17 mce_timer variable.
  18
  19 If more than one CPU writes a specific value to the check_interval file
  20 concurrently, mce_timer is not protected from such concurrent accesses and
  21 all kinds of explosions happen. Since only root can write to those sysfs
  22 variables, the issue is not a big deal security-wise.
  23
  24 However, concurrent writes to these configuration variables is void of
  25 reason so the proper thing to do is to serialize the access with a mutex.
  26
  27 Boris:
  28
  29  - Make store_int_with_restart() use device_store_ulong() to filter out
  30    negative intervals
  31  - Limit min interval to 1 second
  32  - Correct locking
  33  - Massage commit message
  34
  35 Signed-off-by: Seunghun Han <kkamagui@gmail.com>
  36 Signed-off-by: Borislav Petkov <bp@suse.de>
  37 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  38 Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  39 Cc: Tony Luck <tony.luck@intel.com>
  40 Cc: linux-edac <linux-edac@vger.kernel.org>
  41 Cc: stable@vger.kernel.org
  42 Link: http://lkml.kernel.org/r/20180302202706.9434-1-kkamagui@gmail.com
  43 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  44
  45 ---
  46  arch/x86/kernel/cpu/mcheck/mce.c |   22 +++++++++++++++++++++-
  47  1 file changed, 21 insertions(+), 1 deletion(-)
  48
  49 --- a/arch/x86/kernel/cpu/mcheck/mce.c
  50 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
  51 @@ -57,6 +57,9 @@
  52
  53  static DEFINE_MUTEX(mce_log_mutex);
  54
  55 +/* sysfs synchronization */
  56 +static DEFINE_MUTEX(mce_sysfs_mutex);
  57 +
  58  #define CREATE_TRACE_POINTS
  59  #include <trace/events/mce.h>
  60
  61 @@ -2080,6 +2083,7 @@ static ssize_t set_ignore_ce(struct devi
  62         if (kstrtou64(buf, 0, &new) < 0)
  63                 return -EINVAL;
  64
  65 +       mutex_lock(&mce_sysfs_mutex);
  66         if (mca_cfg.ignore_ce ^ !!new) {
  67                 if (new) {
  68                         /* disable ce features */
  69 @@ -2092,6 +2096,8 @@ static ssize_t set_ignore_ce(struct devi
  70                         on_each_cpu(mce_enable_ce, (void *)1, 1);
  71                 }
  72         }
  73 +       mutex_unlock(&mce_sysfs_mutex);
  74 +
  75         return size;
  76  }
  77
  78 @@ -2104,6 +2110,7 @@ static ssize_t set_cmci_disabled(struct
  79         if (kstrtou64(buf, 0, &new) < 0)
  80                 return -EINVAL;
  81
  82 +       mutex_lock(&mce_sysfs_mutex);
  83         if (mca_cfg.cmci_disabled ^ !!new) {
  84                 if (new) {
  85                         /* disable cmci */
  86 @@ -2115,6 +2122,8 @@ static ssize_t set_cmci_disabled(struct
  87                         on_each_cpu(mce_enable_ce, NULL, 1);
  88                 }
  89         }
  90 +       mutex_unlock(&mce_sysfs_mutex);
  91 +
  92         return size;
  93  }
  94
  95 @@ -2122,8 +2131,19 @@ static ssize_t store_int_with_restart(st
  96                                       struct device_attribute *attr,
  97                                       const char *buf, size_t size)
  98  {
  99 -       ssize_t ret = device_store_int(s, attr, buf, size);
 100 +       unsigned long old_check_interval = check_interval;
 101 +       ssize_t ret = device_store_ulong(s, attr, buf, size);
 102 +
 103 +       if (check_interval == old_check_interval)
 104 +               return ret;
 105 +
 106 +       if (check_interval < 1)
 107 +               check_interval = 1;
 108 +
 109 +       mutex_lock(&mce_sysfs_mutex);
 110         mce_restart();
 111 +       mutex_unlock(&mce_sysfs_mutex);
 112 +
 113         return ret;
 114  }
 115