x86/membarrier: Get rid of a dubious optimization

BugLink: https://bugs.launchpad.net/bugs/1910816
commit a493d1ca1a03b532871f1da27f8dbda2b28b04c4 upstream.

sync_core_before_usermode() had an incorrect optimization.  If the kernel
returns from an interrupt, it can get to usermode without IRET. It just has
to schedule to a different task in the same mm and do SYSRET.  Fortunately,
there were no callers of sync_core_before_usermode() that could have had
in_irq() or in_nmi() equal to true, because it's only ever called from the
scheduler.

While at it, clarify a related comment.

Fixes: 70216e18e519 ("membarrier: Provide core serializing command, *_SYNC_CORE")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/5afc7632be1422f91eaf7611aaaa1b5b8580a086.1607058304.git.luto@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>

diff --git a/arch/x86/include/asm/sync_core.h b/arch/x86/include/asm/sync_core.h
index c67caafd3381722dd6bb76dac8c5639f6bf2bba8..43b5e02a7b4b9b5a24c379d8089ace2cbf685980 100644 (file)
--- a/arch/x86/include/asm/sync_core.h
+++ b/arch/x86/include/asm/sync_core.h
@@ -16,12 +16,13 @@ static inline void sync_core_before_usermode(void)
        /* With PTI, we unconditionally serialize before running user code. */
        if (static_cpu_has(X86_FEATURE_PTI))
                return;
+
        /*
-        * Return from interrupt and NMI is done through iret, which is core
-        * serializing.
+        * Even if we're in an interrupt, we might reschedule before returning,
+        * in which case we could switch to a different thread in the same mm
+        * and return using SYSRET or SYSEXIT.  Instead of trying to keep
+        * track of our need to sync the core, just sync right away.
         */
-       if (in_irq() || in_nmi())
-               return;
        sync_core();
 }
 

diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index e6a9edc5baaf07b99925519351a895520e2d7949..851359b7edc571ef392c2ddacc9a628fd852f0a6 100644 (file)
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -327,8 +327,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
        /*
         * The membarrier system call requires a full memory barrier and
         * core serialization before returning to user-space, after
-        * storing to rq->curr. Writing to CR3 provides that full
-        * memory barrier and core serializing instruction.
+        * storing to rq->curr, when changing mm.  This is because
+        * membarrier() sends IPIs to all CPUs that are in the target mm
+        * to make them issue memory barriers.  However, if another CPU
+        * switches to/from the target mm concurrently with
+        * membarrier(), it can cause that CPU not to receive an IPI
+        * when it really should issue a memory barrier.  Writing to CR3
+        * provides that full memory barrier and core serializing
+        * instruction.
         */
        if (real_prev == next) {
                VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) !=