AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
f6f8076655
kernel_optimize_test/arch
History
Mike Rapoport 12551b75b0 x86/mm: Fix kern_addr_valid() to cope with existing but not present entries 
commit 34b1999da935a33be6239226bfa6cd4f704c5c88 upstream.

Jiri Olsa reported a fault when running:

  # cat /proc/kallsyms | grep ksys_read
  ffffffff8136d580 T ksys_read
  # objdump -d --start-address=0xffffffff8136d580 --stop-address=0xffffffff8136d590 /proc/kcore

  /proc/kcore:     file format elf64-x86-64

  Segmentation fault

  general protection fault, probably for non-canonical address 0xf887ffcbff000: 0000 [#1] SMP PTI
  CPU: 12 PID: 1079 Comm: objdump Not tainted 5.14.0-rc5qemu+ #508
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014
  RIP: 0010:kern_addr_valid
  Call Trace:
   read_kcore
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? trace_hardirqs_on
   ? rcu_read_lock_sched_held
   ? lock_acquire
   ? lock_acquire
   ? rcu_read_lock_sched_held
   ? lock_acquire
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? lock_release
   ? _raw_spin_unlock
   ? __handle_mm_fault
   ? rcu_read_lock_sched_held
   ? lock_acquire
   ? rcu_read_lock_sched_held
   ? lock_release
   proc_reg_read
   ? vfs_read
   vfs_read
   ksys_read
   do_syscall_64
   entry_SYSCALL_64_after_hwframe

The fault happens because kern_addr_valid() dereferences existent but not
present PMD in the high kernel mappings.

Such PMDs are created when free_kernel_image_pages() frees regions larger
than 2Mb. In this case, a part of the freed memory is mapped with PMDs and
the set_memory_np_noalias() -> ... -> __change_page_attr() sequence will
mark the PMD as not present rather than wipe it completely.

Have kern_addr_valid() check whether higher level page table entries are
present before trying to dereference them to fix this issue and to avoid
similar issues in the future.

Stable backporting note:
------------------------

Note that the stable marking is for all active stable branches because
there could be cases where pagetable entries exist but are not valid -
see 9a14aefc1d ("x86: cpa, fix lookup_address"), for example. So make
sure to be on the safe side here and use pXY_present() accessors rather
than pXY_none() which could #GP when accessing pages in the direct map.

Also see:

  c40a56a781 ("x86/mm/init: Remove freed kernel image areas from alias mapping")

for more info.

Reported-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Tested-by: Jiri Olsa <jolsa@redhat.com>
Cc: <stable@vger.kernel.org>	# 4.4+
Link: https://lkml.kernel.org/r/20210819132717.19358-1-rppt@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-22 12:27:56 +02:00
..
alpha alpha: Send stop IPI to send to online CPUs 2021-08-12 13:22:20 +02:00
arc ARC: Fix CONFIG_STACKDEPOT 2021-09-03 10:09:21 +02:00
arm ARM: tegra: tamonten: Fix UART pad setting 2021-09-18 13:40:28 +02:00
arm64 arm64/sve: Use correct size when reinitialising SVE state 2021-09-22 12:27:54 +02:00
c6x
csky csky: syscache: Fixup duplicate cache flush 2021-07-14 16:56:52 +02:00
h8300 h8300: fix PREEMPTION build, TI_PRE_COUNT undefined 2021-02-17 11:02:28 +01:00
hexagon hexagon: use common DISCARDS macro 2021-07-20 16:05:53 +02:00
ia64 mm/page_alloc: fix memory map initialization for descending nodes 2021-07-25 14:36:18 +02:00
m68k m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch 2021-09-18 13:40:31 +02:00
microblaze local64.h: make <asm/local64.h> mandatory 2021-01-12 20:18:16 +01:00
mips MIPS: Malta: fix alignment of the devicetree buffer 2021-09-18 13:40:16 +02:00
nds32 nds32: fix up stack guard gap 2021-07-28 14:35:46 +02:00
nios2 nios2: fixed broken sys_clone syscall 2021-03-04 11:38:16 +01:00
openrisc openrisc: don't printk() unconditionally 2021-09-18 13:40:13 +02:00
parisc parisc: fix crash with signals and alloca 2021-09-18 13:40:35 +02:00
powerpc KVM: PPC: Fix clearing never mapped TCEs in realmode 2021-09-18 13:40:16 +02:00
riscv riscv: Fixup patch_text panic in ftrace 2021-09-03 10:09:29 +02:00
s390 s390/pv: fix the forcing of the swiotlb 2021-09-18 13:40:36 +02:00
sh sched/core: Initialize the idle task with preemption disabled 2021-07-14 16:55:50 +02:00
sparc bpf: Introduce BPF nospec instruction for mitigating Spectre v4 2021-08-04 12:46:44 +02:00
um um: fix error return code in winch_tramp() 2021-07-20 16:05:51 +02:00
x86 x86/mm: Fix kern_addr_valid() to cope with existing but not present entries 2021-09-22 12:27:56 +02:00
xtensa xtensa: ISS: don't panic in rs_init 2021-09-18 13:40:22 +02:00
.gitignore
Kconfig fanotify: Fix sys_fanotify_mark() on native x86-32 2021-01-17 14:16:59 +01:00