Re: [syzbot] [kernel?] WARNING in do_clear_cpu_cap

[Borislav Petkov]

On Fri, Jul 31, 2026 at 10:35:26AM -0700, Andrew Morton wrote:
> On Fri, 31 Jul 2026 10:13:34 -0700 syzbot <syzbot+6cdbd5e494b199d820c3@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    11028ab62899 Merge tag 'probes-fixes-v7.2-rc5' of git://gi..
> > git tree:       upstream
> > console+strace: https://syzkaller.appspot.com/x/log.txt?x=14e3d9b9580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=cb17729fb04b1e3a
> > dashboard link: https://syzkaller.appspot.com/bug?extid=6cdbd5e494b199d820c3
> > compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13b271b9580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=118a97b1580000
> > 
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/bc967be819a3/disk-11028ab6.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/6e9f003c9cc8/vmlinux-11028ab6.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/5c292926486f/bzImage-11028ab6.xz
> > 
> > The issue was bisected to:
> > 
> > commit 684826f8271ad97580b138b9ffd462005e470b99
> > Author: Sergey Senozhatsky <senozhatsky@xxxxxxxxxxxx>
> > Date:   Wed Sep 11 02:54:56 2024 +0000
> > 
> >     zram: free secondary algorithms names
> 
> Thanks.  I don't see how zram could have caused this.
> 
> fwiw (which might not be a lot), Gemini concluded
> 
> 
> Core Issue & Summary
> 
>   Root Cause: CPU capability clearing (clear_cpu_cap /
>   setup_clear_cpu_cap) was executed during late CPU feature detection
>   on a secondary core (identify_secondary_cpu()) after kernel
>   alternatives patching was finalized (alternatives_patched == true).
> 
> Fix Location:
> 
>   The bug needs to be addressed in arch/x86/kernel/cpu/intel.c
>   (specifically around early_init_intel()) by ensuring that capability
>   overrides/clears are done prior to alternative patching or handled
>   via per-CPU feature suppression mechanisms that don't invoke full
>   feature mask clearing post-patching.
> 
> https://gemini.google.com/share/0cdd1930799f?skid=006fb41e-8e42-4330-9f52-62c4cf089ce0

        if (c->x86_vfm >= INTEL_PENTIUM_M_DOTHAN) {
                rdmsrq(MSR_IA32_MISC_ENABLE, misc_enable);
                if (misc_enable & MSR_IA32_MISC_ENABLE_FAST_STRING) {
                        /* X86_FEATURE_ERMS is set based on CPUID */
                        set_cpu_cap(c, X86_FEATURE_REP_GOOD);
                } else {
                        pr_info("Disabled fast string operations\n");
<---                    setup_clear_cpu_cap(X86_FEATURE_REP_GOOD);
                        setup_clear_cpu_cap(X86_FEATURE_ERMS);
                }
        }


So the guest tried to read MSR_IA32_MISC_ENABLE and the google HV did whatever
it wanted to intercept or not that MSR but the
MSR_IA32_MISC_ENABLE_FAST_STRING bit was clear so we complain because we clear
our flags too late here.

Nothing to see here...

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette