Skip to content

Commit

Permalink
x86/tsc: Validate cpumask pointer before accessing it
Browse files Browse the repository at this point in the history
0-day testing encountered a NULL pointer dereference in a cpumask access
from tsc_store_and_check_tsc_adjust().

This happens when the function is called on the boot CPU and the topology
masks are not yet available due to CPUMASK_OFFSTACK=y.

Add a NULL pointer check for the mask pointer. If NULL it's safe to assume
that the CPU is the boot CPU and the first one in the package.

Fixes: 8b223bc ("x86/tsc: Store and check TSC ADJUST MSR")
Reported-by: kernel test robot <xiaolong.ye@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  • Loading branch information
Thomas Gleixner committed Dec 1, 2016
1 parent b836554 commit 31f8a65
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions arch/x86/kernel/tsc_sync.c
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,7 @@ bool tsc_store_and_check_tsc_adjust(void)
{
struct tsc_adjust *ref, *cur = this_cpu_ptr(&tsc_adjust);
unsigned int refcpu, cpu = smp_processor_id();
struct cpumask *mask;
s64 bootval;

if (!boot_cpu_has(X86_FEATURE_TSC_ADJUST))
Expand All @@ -98,9 +99,11 @@ bool tsc_store_and_check_tsc_adjust(void)
* Check whether this CPU is the first in a package to come up. In
* this case do not check the boot value against another package
* because the package might have been physically hotplugged, where
* TSC_ADJUST is expected to be different.
* TSC_ADJUST is expected to be different. When called on the boot
* CPU topology_core_cpumask() might not be available yet.
*/
refcpu = cpumask_any_but(topology_core_cpumask(cpu), cpu);
mask = topology_core_cpumask(cpu);
refcpu = mask ? cpumask_any_but(mask, cpu) : nr_cpu_ids;

if (refcpu >= nr_cpu_ids) {
/*
Expand Down

0 comments on commit 31f8a65

Please sign in to comment.