diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2025-08-13 17:02:30 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2025-09-13 19:51:59 +0200 |
| commit | 6eb350a2233100a283f882c023e5ad426d0ed63b (patch) | |
| tree | db0fedfe420652a4ad1fd85fe69dfafb71a930db /kernel | |
| parent | Linux 6.17-rc5 (diff) | |
| download | linux-6eb350a2233100a283f882c023e5ad426d0ed63b.tar.gz linux-6eb350a2233100a283f882c023e5ad426d0ed63b.zip | |
rseq: Protect event mask against membarrier IPI
rseq_need_restart() reads and clears task::rseq_event_mask with preemption
disabled to guard against the scheduler.
But membarrier() uses an IPI and sets the PREEMPT bit in the event mask
from the IPI, which leaves that RMW operation unprotected.
Use guard(irq) if CONFIG_MEMBARRIER is enabled to fix that.
Fixes: 2a36ab717e8f ("rseq/membarrier: Add MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Boqun Feng <boqun.feng@gmail.com>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: stable@vger.kernel.org
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/rseq.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/kernel/rseq.c b/kernel/rseq.c index b7a1ec327e81..2452b7366b00 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -342,12 +342,12 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) /* * Load and clear event mask atomically with respect to - * scheduler preemption. + * scheduler preemption and membarrier IPIs. */ - preempt_disable(); - event_mask = t->rseq_event_mask; - t->rseq_event_mask = 0; - preempt_enable(); + scoped_guard(RSEQ_EVENT_GUARD) { + event_mask = t->rseq_event_mask; + t->rseq_event_mask = 0; + } return !!event_mask; } |