CVE-2023-53656

In the Linux kernel, the following vulnerability has been resolved:

drivers/perf: hisi: Dont migrate perf to the CPU going to teardown

The driver needs to migrate the perf context if the current using CPU going to teardown. By the time calling the cpuhp::teardown() callback the cpu_online_mask() hasnt updated yet and still includes the CPU going to teardown. In current drivers implementation we may migrate the context to the teardown CPU and leads to the below calltrace:

… [ 368.104662][ T932] task:cpuhp/0 state:D stack: 0 pid: 15 ppid: 2 flags:0x00000008 [ 368.113699][ T932] Call trace: [ 368.116834][ T932] __switch_to+0x7c/0xbc [ 368.120924][ T932] __schedule+0x338/0x6f0 [ 368.125098][ T932] schedule+0x50/0xe0 [ 368.128926][ T932] schedule_preempt_disabled+0x18/0x24 [ 368.134229][ T932] __mutex_lock.constprop.0+0x1d4/0x5dc [ 368.139617][ T932] __mutex_lock_slowpath+0x1c/0x30 [ 368.144573][ T932] mutex_lock+0x50/0x60 [ 368.148579][ T932] perf_pmu_migrate_context+0x84/0x2b0 [ 368.153884][ T932] hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu] [ 368.160579][ T932] cpuhp_invoke_callback+0x2a0/0x650 [ 368.165707][ T932] cpuhp_thread_fun+0xe4/0x190 [ 368.170316][ T932] smpboot_thread_fn+0x15c/0x1a0 [ 368.175099][ T932] kthread+0x108/0x13c [ 368.179012][ T932] ret_from_fork+0x10/0x18 …

Use function cpumask_any_but() to find one correct active cpu to fixes this issue.

Affected Software

References

• https://git.kernel.org/stable/c/7a6a9f1c5a0a875a421db798d4b2ee022dc1ee1a
• https://git.kernel.org/stable/c/b64569897d86b611befbb895d815280fea94e1ed
• https://git.kernel.org/stable/c/be9c8c9c84b6d25a7b7d39954030aba6f759feb6
• https://git.kernel.org/stable/c/f564e543a43d0f1cabac791672c8a6fc78ce12d0