x86/mm: Fix global ASID handed out to two processes

On AMD CPUs with INVLPGB, two live processes can get the same MAX_ASID_AVAILABLE
global ASID value. The two then hit each other's TLB entries, so each can read
or corrupt the other's memory.

The global ASID space is managed lazily. When a global ASID is freed, its bit is
set in the global_asid_freed bitmap. Once the free ASID search reaches the end
of the global_asid_used bitmap, a global flush is done to really reclaim the
lazily freed global ASIDs.

However, the current code can assign the same global ASID to two different
processes, if one process is assigned MAX_ASID_AVAILABLE - 1, another process
MAX_ASID_AVAILABLE, and both stick around (keeping their global ASID numbers in
use) until the search wraps around again.  At that point a third process could
also get assigned MAX_ASID_AVAILABLE.

    the highest ASID stays in use, so it is not handed out again
      last_global_asid stays below it, so no reset
        the clear bits run out
          find_next_zero_bit() returns MAX_ASID_AVAILABLE
            global_asid_available > 0, so the failure is not caught
              MAX_ASID_AVAILABLE is handed out as an ASID

A search only looks at the bits below MAX_ASID_AVAILABLE, so it cannot see that
this value is in use. The next failed search hands it out again, even if the
first process still holds it.

The fix used here is to reset the global ASID space after a failed search, and
to search again. If that search fails too, no global ASID is handed out.

The test for !global_asid_available is removed, because use_global_asid() only
calls allocate_global_asid() if global_asid_available > 0. The remaining test is
for a condition that should be impossible.

  [ riel: simplify code, massage changelog and comment ]

Fixes: d504d1247e36 ("x86/mm: Add global ASID allocation helper functions")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: <stable@kernel.org>

0 files changed, 0 insertions, 0 deletions