From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757374AbcGJSSR (ORCPT ); Sun, 10 Jul 2016 14:18:17 -0400 Received: from terminus.zytor.com ([198.137.202.10]:54014 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755819AbcGJSSM (ORCPT ); Sun, 10 Jul 2016 14:18:12 -0400 Date: Sun, 10 Jul 2016 11:16:26 -0700 From: tip-bot for Thomas Garnier Message-ID: Cc: mingo@kernel.org, peterz@infradead.org, hpa@zytor.com, tglx@linutronix.de, decui@microsoft.com, sai.praneeth.prakhya@intel.com, luto@kernel.org, borntraeger@de.ibm.com, bp@alien8.de, linux-kernel@vger.kernel.org, matt@codeblueprint.co.uk, chris@chris-wilson.co.uk, thgarnie@google.com, bp@suse.de, keescook@chromium.org, dvlasenk@redhat.com, brgerst@gmail.com, torvalds@linux-foundation.org, jpoimboe@redhat.com, toshi.kani@hpe.com Reply-To: tglx@linutronix.de, hpa@zytor.com, peterz@infradead.org, mingo@kernel.org, luto@kernel.org, decui@microsoft.com, sai.praneeth.prakhya@intel.com, borntraeger@de.ibm.com, chris@chris-wilson.co.uk, thgarnie@google.com, matt@codeblueprint.co.uk, linux-kernel@vger.kernel.org, bp@alien8.de, keescook@chromium.org, bp@suse.de, dvlasenk@redhat.com, brgerst@gmail.com, toshi.kani@hpe.com, jpoimboe@redhat.com, torvalds@linux-foundation.org In-Reply-To: <20160615190545.GA26071@www.outflux.net> References: <20160615190545.GA26071@www.outflux.net> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/boot] x86/mm: Do not reference phys addr beyond kernel Git-Commit-ID: 4ff5308744f5858e4e49e56a0445e2f8b73e47e0 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 4ff5308744f5858e4e49e56a0445e2f8b73e47e0 Gitweb: http://git.kernel.org/tip/4ff5308744f5858e4e49e56a0445e2f8b73e47e0 Author: Thomas Garnier AuthorDate: Wed, 15 Jun 2016 12:05:45 -0700 Committer: Ingo Molnar CommitDate: Sun, 10 Jul 2016 17:21:37 +0200 x86/mm: Do not reference phys addr beyond kernel The new physical address randomized KASLR implementation can cause the kernel to be aligned close to the end of physical memory. In this case, _brk_end aligned to PMD will go beyond what is expected safe and hit the assert in __phys_addr_symbol(): VIRTUAL_BUG_ON(y >= KERNEL_IMAGE_SIZE); Instead, perform an inclusive range check to avoid incorrectly triggering the assert: kernel BUG at arch/x86/mm/physaddr.c:38! invalid opcode: 0000 [#1] SMP ... RIP: 0010:[] __phys_addr_symbol+0x41/0x50 ... Call Trace: [] cpa_process_alias+0xa9/0x210 [] ? do_raw_spin_unlock+0xc1/0x100 [] __change_page_attr_set_clr+0x8cf/0xbd0 [] ? vm_unmap_aliases+0x7d/0x210 [] change_page_attr_set_clr+0x18c/0x4e0 [] set_memory_4k+0x2c/0x40 [] check_bugs+0x28/0x2a [] start_kernel+0x49d/0x4b9 [] ? early_idt_handler_array+0x120/0x120 [] x86_64_start_reservations+0x29/0x2b [] x86_64_start_kernel+0x143/0x152 Signed-off-by: Thomas Garnier Signed-off-by: Kees Cook Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Borislav Petkov Cc: Brian Gerst Cc: Chris Wilson Cc: Christian Borntraeger Cc: Denys Vlasenko Cc: Dexuan Cui Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Sai Praneeth Cc: Thomas Gleixner Cc: Toshi Kani Link: http://lkml.kernel.org/r/20160615190545.GA26071@www.outflux.net Signed-off-by: Ingo Molnar --- arch/x86/mm/pageattr.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c index 7a1f7bb..379b511 100644 --- a/arch/x86/mm/pageattr.c +++ b/arch/x86/mm/pageattr.c @@ -101,7 +101,8 @@ static inline unsigned long highmap_start_pfn(void) static inline unsigned long highmap_end_pfn(void) { - return __pa_symbol(roundup(_brk_end, PMD_SIZE)) >> PAGE_SHIFT; + /* Do not reference physical address outside the kernel. */ + return __pa_symbol(roundup(_brk_end, PMD_SIZE) - 1) >> PAGE_SHIFT; } #endif @@ -112,6 +113,12 @@ within(unsigned long addr, unsigned long start, unsigned long end) return addr >= start && addr < end; } +static inline int +within_inclusive(unsigned long addr, unsigned long start, unsigned long end) +{ + return addr >= start && addr <= end; +} + /* * Flushing functions */ @@ -1316,7 +1323,8 @@ static int cpa_process_alias(struct cpa_data *cpa) * to touch the high mapped kernel as well: */ if (!within(vaddr, (unsigned long)_text, _brk_end) && - within(cpa->pfn, highmap_start_pfn(), highmap_end_pfn())) { + within_inclusive(cpa->pfn, highmap_start_pfn(), + highmap_end_pfn())) { unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) + __START_KERNEL_map - phys_base; alias_cpa = *cpa;