[xen staging-4.19] x86/SMP: guard socket_cpumask[] access in cpu_smpboot_free()

[patchbot@xxxxxxx]

commit 687ae6747d415e428ff8fdd2d0b0e7d45e2ce73c
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Jul 22 09:59:35 2025 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jul 22 09:59:35 2025 +0200

    x86/SMP: guard socket_cpumask[] access in cpu_smpboot_free()
    
    Before CPU identification has run (and it may not have run at all e.g.
    when AP bringup failed altogether), cpu_data[].phys_proc_id (which is
    what cpu_to_socket() resolves to) can't really be used. The use of
    cpu_to_socket()'s result as an array index in cpu_smpboot_free()
    therefore needs guarding, as the function will also be invoked upon AP
    bringup failure, in which case CPU identification may not have run.
    
    Without "x86/CPU: re-work populating of cpu_data[]" [1] the issue is
    less pronounced: The field starts out as zero, then has the BSP value
    (likely again zero) copied into it, and it is properly invalidated only
    in cpu_smpboot_free(). Still it is clearly wrong to use the BSP's socket
    number here.
    
    Making the guard work with and without the above patch applied turns out
    interesting: Prior to that patch, the sole invalidation done is that in
    cpu_smpboot_free(). Upon a later bringup attempt, the fields invalidated
    are overwritten by the BSP values again, though. Hence compare APIC IDs,
    as they cannot validly be the same once CPU identification has run.
    
    [1] https://lists.xen.org/archives/html/xen-devel/2024-02/msg00727.html
    
    Fixes: 4824bdfdabeb ("x86: add socket_cpumask")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    master commit: 8c15d3d18725c3482c0a06764478ea32221ec075
    master date: 2025-07-17 12:47:04 +0200
---
 xen/arch/x86/smpboot.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
index 386e6a0849..1c13e7cfb0 100644
--- a/xen/arch/x86/smpboot.c
+++ b/xen/arch/x86/smpboot.c
@@ -957,7 +957,13 @@ static void cpu_smpboot_free(unsigned int cpu, bool remove)
     unsigned int socket = cpu_to_socket(cpu);
     struct cpuinfo_x86 *c = cpu_data;
 
-    if ( cpumask_empty(socket_cpumask[socket]) )
+    /*
+     * We may come here without the CPU having run through CPU identification.
+     * In that case the socket number cannot be relied upon, but the respective
+     * socket_cpumask[] slot also wouldn't have been set.
+     */
+    if ( c[cpu].apicid != boot_cpu_data.apicid &&
+         cpumask_empty(socket_cpumask[socket]) )
     {
         xfree(socket_cpumask[socket]);
         socket_cpumask[socket] = NULL;
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.19