[PATCH] x86/mm/pti: Handle unaligned addr to PMD-mapped page in pti_clone_pgtable

[PATCH] x86/mm/pti: Handle unaligned addr to PMD-mapped page in pti_clone_pgtable

[Song Liu]

To clone page table of PMD-mapped pages, pti_clone_pgtable() requires PMD
aligned start address. [1] adds warning for unaligned addresses. However,
there is still no warning for unaligned address to valid huge pmd [2].

Add alignment check in valid pmd_large() case. If the address is
unaligned, round it down to the nearest PMD aligned address and show
warning.

[1] commit 825d0b73cd75 ("x86/mm/pti: Handle unaligned address gracefully
                          in pti_clone_pagetable()")
[2] https://lore.kernel.org/lkml/156864062019.3407.14798418565580024723.tglx@nanos.tec.linutronix.de/

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Song Liu <songliubraving@fb.com>
---
 arch/x86/mm/pti.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 7f2140414440..d224115c350d 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -343,6 +343,10 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
 		}
 
 		if (pmd_large(*pmd) || level == PTI_CLONE_PMD) {
+			/* warn and round_down() unaligned addr */
+			if (WARN_ON_ONCE(addr & ~PMD_MASK))
+				addr &= PMD_MASK;
+
 			target_pmd = pti_user_pagetable_walk_pmd(addr);
 			if (WARN_ON(!target_pmd))
 				return;
-- 
2.17.1

Re: [PATCH] x86/mm/pti: Handle unaligned addr to PMD-mapped page in pti_clone_pgtable

[Peter Zijlstra]

On Wed, Sep 18, 2019 at 10:53:12PM -0700, Song Liu wrote:
> To clone page table of PMD-mapped pages, pti_clone_pgtable() requires PMD
> aligned start address. [1] adds warning for unaligned addresses. However,
> there is still no warning for unaligned address to valid huge pmd [2].
> 
> Add alignment check in valid pmd_large() case. If the address is
> unaligned, round it down to the nearest PMD aligned address and show
> warning.
> 
> [1] commit 825d0b73cd75 ("x86/mm/pti: Handle unaligned address gracefully
>                           in pti_clone_pagetable()")
> [2] https://lore.kernel.org/lkml/156864062019.3407.14798418565580024723.tglx@nanos.tec.linutronix.de/
> 
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@kernel.org>
> Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Song Liu <songliubraving@fb.com>
> ---
>  arch/x86/mm/pti.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
> index 7f2140414440..d224115c350d 100644
> --- a/arch/x86/mm/pti.c
> +++ b/arch/x86/mm/pti.c
> @@ -343,6 +343,10 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
>  		}
>  
>  		if (pmd_large(*pmd) || level == PTI_CLONE_PMD) {
> +			/* warn and round_down() unaligned addr */
> +			if (WARN_ON_ONCE(addr & ~PMD_MASK))
> +				addr &= PMD_MASK;
> +
>  			target_pmd = pti_user_pagetable_walk_pmd(addr);
>  			if (WARN_ON(!target_pmd))
>  				return;

I'm conflicted on this one... the only use of addr here is
pti_user_pagetable_walk_pmd() and that already masks things, so the
fixup is 'pointless'.

Also the location is weird; we'd want to do alignment enforcement before
we commence the for-loop, methinks.

Re: [PATCH] x86/mm/pti: Handle unaligned addr to PMD-mapped page in pti_clone_pgtable

[Linus Torvalds]

On Mon, Sep 23, 2019 at 4:28 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> I'm conflicted on this one... the only use of addr here is
> pti_user_pagetable_walk_pmd() and that already masks things, so the
> fixup is 'pointless'.

No it's not.

The *other* use of 'addr' is

        addr += PMD_SIZE;

and then repeat the loop.

And that repeat might then use it for the page-level case the next iteration.

> Also the location is weird; we'd want to do alignment enforcement before
> we commence the for-loop, methinks.

No. See again. The alignment is different for the different cases
inside the loop. Some do per-page stuff, some do per-pmd stuff, and
some do per-pud stuff.

And you don't know which you'll hit a-priori (because it's not limited
to the 'level' testing).

           Linus