Recently we encounter multi #MC on the same task when it's task_work_run() has not been called, current->mce_kill_me was added to task_works list more than once, that make a circular linked task_works, so task_work_run() will do a endless loop.

More seriously, the SIGBUS signal can not be delivered to the userspace task which tigger the #MC and I met #MC flood.

I borrowed mce_kill_me.func to check whether current->mce_kill_me has been added to task_works, prevent duplicate addition. When work function be called, the task_works must has been taken, so it is safe to be cleared in callback.

Fixed: commit 5567d11c21a1 ("x86/mce: Send #MC singal from task work") Cc: stable@vger.kernel.org #v5.8+ Signed-off-by: Ding Hui dinghui@sangfor.com.cn --- arch/x86/kernel/cpu/mce/core.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c index 22791aadc085..32fb9ded6b85 100644 --- a/arch/x86/kernel/cpu/mce/core.c +++ b/arch/x86/kernel/cpu/mce/core.c @@ -1250,6 +1250,7 @@ static void __mc_scan_banks(struct mce *m, struct pt_regs *regs, struct mce *fin

static void kill_me_now(struct callback_head *ch) { + WRITE_ONCE(ch->func, NULL); force_sig(SIGBUS); }

@@ -1259,6 +1260,8 @@ static void kill_me_maybe(struct callback_head *cb) int flags = MF_ACTION_REQUIRED; int ret;

+ WRITE_ONCE(cb->func, NULL); + pr_err("Uncorrected hardware memory error in user-access at %llx", p->mce_addr);

if (!p->mce_ripv) @@ -1289,17 +1292,20 @@ static void kill_me_maybe(struct callback_head *cb)

static void queue_task_work(struct mce *m, int kill_current_task) { + struct callback_head ch; + current->mce_addr = m->addr; current->mce_kflags = m->kflags; current->mce_ripv = !!(m->mcgstatus & MCG_STATUS_RIPV); current->mce_whole_page = whole_page(m);

if (kill_current_task) - current->mce_kill_me.func = kill_me_now; + ch.func = kill_me_now; else - current->mce_kill_me.func = kill_me_maybe; + ch.func = kill_me_maybe;

- task_work_add(current, &current->mce_kill_me, TWA_RESUME); + if (!cmpxchg(&current->mce_kill_me.func, NULL, ch.func)) + task_work_add(current, &current->mce_kill_me, TWA_RESUME); }

/*