diff options
| author | Ihor Solodrai <ihor.solodrai@linux.dev> | 2026-09-16 12:52:03 -0700 |
|---|---|---|
| committer | Borislav Petkov (AMD) <bp@alien8.de> | 2026-09-17 02:05:39 +0200 |
| commit | 2711d67bc3a776abcfc651ad87be5d29ada19166 (patch) | |
| tree | 252943ab9ff5c0d5a2a41dc63c4b26aa1ea7485c /kernel | |
| parent | db349783ca7aa99345f3809523bff2db8f8714de (diff) | |
| download | linux-next-2711d67bc3a776abcfc651ad87be5d29ada19166.tar.gz linux-next-2711d67bc3a776abcfc651ad87be5d29ada19166.zip | |
x86/cpu: Don't transiently clear the boot CPU's capabilities
On the boot CPU, identify_cpu() runs from arch_cpu_finalize_init(), with
interrupts enabled and before alternatives are patched. So
cpu_feature_enabled() still evaluates against boot_cpu_data.
identify_cpu() rebuilds c->x86_capability from scratch: the reset zeroes the
array and the CPUID rescan fills it in again. An interrupt delivered in that
window finds X86_FEATURE_LA57 clear in boot_cpu_data, so pgtable_l5_enabled()
is false and KASAN checks a 5-level address against the 4-level addressability
limit. The result is a bogus "wild-memory-access" report, and under
kasan_multi_shot a report storm that wedges the boot.
The boot CPU has already been scanned by early_identify_cpu(), with interrupts
disabled, and its capabilities cannot have changed since. Reset only the CPUs
which have not been scanned yet.
The window is as old as identify_cpu() rebuilding the capabilities. Commit
39b9552281ab ("x86/mm: Optimize boot-time paging mode switching cost")
merely let KASAN notice it by making pgtable_l5_enabled() read the feature
bit. So no Fixes: tag.
Closes: https://lore.kernel.org/bpf/20260610175651.647515-1-ihor.solodrai@linux.dev/
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260916195203.1099646-6-ihor.solodrai@linux.dev
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions
