CVE-2023-53169

In the Linux kernel, the following vulnerability has been resolved:

x86/resctrl: Clear staged_config[] before and after it is used

As a temporary storage, stagedconfig[] in rdtdomain should be cleared before and after it is used. The stale value in staged_config[] could cause an MSR access error.

Here is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3 Cache (MBA should be disabled if the number of CLOSIDs for MB is less than 16.) : mount -t resctrl resctrl -o cdp /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..7} umount /sys/fs/resctrl/ mount -t resctrl resctrl /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..8}

An error occurs when creating resource group named p8: unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60) Call Trace: <IRQ> __flushsmpcallfunctionqueue+0x11d/0x170 _sysveccallfunction+0x24/0xd0 sysveccallfunction+0x89/0xc0 </IRQ> <TASK> asmsysveccallfunction+0x16/0x20

When creating a new resource control group, hardware will be configured by the following process: rdtgroupmkdir() rdtgroupmkdirctrlmon() rdtgroupinitalloc() resctrlarchupdate_domains()

resctrlarchupdatedomains() iterates and updates all resctrlconftype whose havenewctrl is true. Since stagedconfig[] holds the same values as when CDP was enabled, it will continue to update the CDPCODE and CDPDATA configurations. When group p8 is created, getconfigindex() called in resctrlarchupdatedomains() will return 16 and 17 as the CLOSIDs for CDPCODE and CDP_DATA, which will be translated to an invalid register - 0xca0 in this scenario.

Fix it by clearing staged_config[] before and after it is used.

[reinette: re-order commit tags]