mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Browse Source 
Pull x86 fix from Ingo Molnar:

 - Prevent OOB access in the resctrl code while offlining
   CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
   (Reinette Chatre)

* tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
This commit is contained in:
Linus Torvalds
2026-07-05 05:37:46 -10:00
parent c10dc5c03e fc16126cc1
commit f105f3631d
2 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
arch/x86/kernel/cpu/resctrl/monitor.c
View File

@@ -259,6 +259,11 @@ int resctrl_arch_rmid_read(struct rdt_resource *r, struct rdt_domain_hdr *hdr,
if (!domain_header_is_valid(hdr, RESCTRL_MON_DOMAIN, RDT_RESOURCE_L3))
return -EINVAL;
if (cpumask_empty(&hdr->cpu_mask)) {
pr_warn_once("Domain %d has no CPUs\n", hdr->id);
return -EINVAL;
}
d = container_of(hdr, struct rdt_l3_mon_domain, hdr);
hw_dom = resctrl_to_arch_mon_dom(d);
cpu = cpumask_any(&hdr->cpu_mask);

37
fs/resctrl/monitor.c
View File

@@ -135,10 +135,10 @@ void __check_limbo(struct rdt_l3_mon_domain *d, bool force_free)
struct rdt_resource *r = resctrl_arch_get_resource(RDT_RESOURCE_L3);
u32 idx_limit = resctrl_arch_system_num_rmid_idx();
struct rmid_entry *entry;
bool rmid_dirty = true;
u32 idx, cur_idx = 1;
void *arch_mon_ctx;
void *arch_priv;
bool rmid_dirty;
u64 val = 0;
arch_priv = mon_event_all[QOS_L3_OCCUP_EVENT_ID].arch_priv;
@@ -161,22 +161,27 @@ void __check_limbo(struct rdt_l3_mon_domain *d, bool force_free)
break;
entry = __rmid_entry(idx);
if (resctrl_arch_rmid_read(r, &d->hdr, entry->closid, entry->rmid,
QOS_L3_OCCUP_EVENT_ID, arch_priv, &val,
arch_mon_ctx)) {
rmid_dirty = true;
} else {
rmid_dirty = (val >= resctrl_rmid_realloc_threshold);
if (!force_free) {
if (resctrl_arch_rmid_read(r, &d->hdr, entry->closid,
entry->rmid, QOS_L3_OCCUP_EVENT_ID,
arch_priv, &val, arch_mon_ctx)) {
rmid_dirty = true;
} else {
rmid_dirty = (val >= resctrl_rmid_realloc_threshold);
/*
* x86's CLOSID and RMID are independent numbers, so the entry's
* CLOSID is an empty CLOSID (X86_RESCTRL_EMPTY_CLOSID). On Arm the
* RMID (PMG) extends the CLOSID (PARTID) space with bits that aren't
* used to select the configuration. It is thus necessary to track both
* CLOSID and RMID because there may be dependencies between them
* on some architectures.
*/
trace_mon_llc_occupancy_limbo(entry->closid, entry->rmid, d->hdr.id, val);
/*
* x86's CLOSID and RMID are independent numbers,
* so the entry's CLOSID is an empty CLOSID
* (X86_RESCTRL_EMPTY_CLOSID). On Arm the RMID
* (PMG) extends the CLOSID (PARTID) space with
* bits that aren't used to select the configuration.
* It is thus necessary to track both CLOSID and
* RMID because there may be dependencies between
* them on some architectures.
*/
trace_mon_llc_occupancy_limbo(entry->closid, entry->rmid,
d->hdr.id, val);
}
}
if (force_free || !rmid_dirty) {