From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_PASS,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0714EC10F0E for ; Wed, 10 Apr 2019 03:17:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A9ED6217D6 for ; Wed, 10 Apr 2019 03:17:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554866260; bh=1TZla5zsJoJ+Fk7s4RQax79cQhIzJ6KroNbI+HWS29o=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=ROIbEaLhuPa9NwLwdQOqIY3obzkiYLBzH3XEfdWmM/KkUqpKy904EjeQaLk9wKuxd xGZqDW0mRQcjEb4VgXdfIkJfx4DO48P4U35JEaWQLSM2t3e6cy8SKAaSUs7r68OlF4 fXNKhrui+f1UTGpXj3BV8m/wDDgctljY2/df6G0w= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726670AbfDJDRj (ORCPT ); Tue, 9 Apr 2019 23:17:39 -0400 Received: from mail.kernel.org ([198.145.29.99]:37246 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726654AbfDJDRj (ORCPT ); Tue, 9 Apr 2019 23:17:39 -0400 Received: from sol.localdomain (c-24-5-143-220.hsd1.ca.comcast.net [24.5.143.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 32FFD20830; Wed, 10 Apr 2019 03:17:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554866257; bh=1TZla5zsJoJ+Fk7s4RQax79cQhIzJ6KroNbI+HWS29o=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=cd4RAQOtwzQ5PoT3sGqUnAge//I834uXVYwGlXTYi3sb7PWEnFuE3NZr1NDVrm29Y CY2AG2eA2bJZ4bNW3u7p050Wvja7UZtUVYkSNZUZIrcB0TIhbhP6q3DpdAIrfFxeKW kdhlE6SKZT3P5Pz671MZj0NJwREmr+eQlY6AfZTE= Date: Tue, 9 Apr 2019 20:17:35 -0700 From: Eric Biggers To: Kees Cook Cc: Geert Uytterhoeven , Herbert Xu , linux-security-module , Linux ARM , Linux Crypto Mailing List , Linux Kernel Mailing List Subject: Re: crypto: Kernel memory overwrite attempt detected to spans multiple pages Message-ID: <20190410031734.GB7140@sol.localdomain> References: <20190319170911.GB202956@gmail.com> <20190320185719.GB180195@gmail.com> <20190321175122.GA1587@sol.localdomain> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190321175122.GA1587@sol.localdomain> User-Agent: Mutt/1.11.4 (2019-03-13) Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org On Thu, Mar 21, 2019 at 10:51:22AM -0700, Eric Biggers wrote: > On Thu, Mar 21, 2019 at 10:45:31AM -0700, Kees Cook wrote: > > On Wed, Mar 20, 2019 at 11:57 AM Eric Biggers wrote: > > > > > > On Tue, Mar 19, 2019 at 10:09:13AM -0700, Eric Biggers wrote: > > > > On Tue, Mar 19, 2019 at 12:54:23PM +0100, Geert Uytterhoeven wrote: > > > > > When running the sha1-asm crypto selftest on arm with > > > > > CONFIG_HARDENED_USERCOPY_PAGESPAN=y: > > > > > > > > > > usercopy: Kernel memory overwrite attempt detected to spans > > > > > multiple pages (offset 0, size 42)! > > > > > ------------[ cut here ]------------ > > > > > kernel BUG at mm/usercopy.c:102! > > > > > Internal error: Oops - BUG: 0 [#1] SMP ARM > > > > > Modules linked in: > > > > > CPU: 0 PID: 35 Comm: cryptomgr_test Not tainted > > > > > 5.1.0-rc1-koelsch-01109-gbeb7d6376ecfbf07-dirty #397 > > > > > Hardware name: Generic R-Car Gen2 (Flattened Device Tree) > > > > > PC is at usercopy_abort+0x68/0x90 > > > > > LR is at usercopy_abort+0x68/0x90 > > > > > pc : [] lr : [] psr: 60000013 > > > > > sp : ea54bc60 ip : 00000010 fp : cccccccd > > > > > r10: 00000000 r9 : c0e0ce04 r8 : ea54d009 > > > > > r7 : ea54d00a r6 : 00000000 r5 : 0000002a r4 : c09d1120 > > > > > r3 : dd6cd422 r2 : dd6cd422 r1 : 2abb4000 r0 : 0000005f > > > > > Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user > > > > > Control: 30c5387d Table: 40003000 DAC: fffffffd > > > > > Process cryptomgr_test (pid: 35, stack limit = 0x(ptrval)) > > > > > Stack: (0xea54bc60 to 0xea54c000) > > > > > bc60: c09d1120 c09d1120 c09d1120 00000000 0000002a 0000002a > > > > > 00000000 c0310060 > > > > > bc80: 0000002a 00000000 000001c0 00000000 00000000 c0eb11e8 > > > > > ea54cfe0 ea538c00 > > > > > bca0: 00000000 ea54cfe0 ebef73e0 0000002a ea538c20 ea54bd84 > > > > > 0000003a c0427a30 > > > > > bcc0: ea54bdbc 00000000 00000000 c081cf70 eb074280 c081cf70 > > > > > 0000002a c081cf80 > > > > > bce0: 0000000e c07da138 ea54bd0c 00000000 c084061c c04248e8 > > > > > c0e0a408 eb074240 > > > > > bd00: eb074200 c04253c8 eb074280 ea550000 00000012 dd6cd422 > > > > > ebef7480 eb074200 > > > > > bd20: ea54bd84 c081cf64 ea537200 00000002 00000000 00000014 > > > > > c084061c c0428c38 > > > > > bd40: ea54bd84 ea54bdbc c081cd34 00000000 c0e4e4b4 ea538c40 > > > > > 00000002 eabe4e80 > > > > > bd60: ea538c00 00000400 ea4f7a00 ea4f7a60 eb074240 00000060 > > > > > 00000006 c09d544c > > > > > bd80: 00000038 00000003 00000000 00000038 ea54bd7c 00000001 > > > > > eb074200 00000000 > > > > > bda0: 00000000 dead4ead ffffffff ffffffff ea54bdb0 ea54bdb0 > > > > > 00000000 c081cf70 > > > > > bdc0: c081ce68 c081ce78 ea4f7480 eb000780 00000dc0 eb000780 > > > > > c0e4ee80 443e9884 > > > > > bde0: 6ed23b1c a14aaeba e52951f9 f17046e5 fefefefe fefefefe > > > > > fefefefe fefefefe > > > > > be00: eb000780 c04292c4 c0e0a638 60000013 60000013 c0305298 > > > > > ea4f7a00 c03062bc > > > > > be20: eb000780 00000cc0 ea4f7a00 dd6cd422 00000cc0 ea538c00 > > > > > 00000002 eabe4e40 > > > > > be40: ea537200 00000007 00000000 ea4f7a00 eb074200 c0429314 > > > > > eb074200 ea538c00 > > > > > be60: ea4f7a00 0000000a eabe4e80 c084061c c08405fc 00000006 > > > > > c04dace8 00000006 > > > > > be80: 00000000 c084065c ea537200 0000000e 00000400 eb04de08 > > > > > ea4f71a8 c0429420 > > > > > bea0: 00000400 ea537200 0000000e ea537200 0000000e c0429374 > > > > > 00000400 ffffffff > > > > > bec0: 000000a2 c042a414 00000103 c0e0a408 00000000 c0e0a438 > > > > > c0e5a2a0 c0e5a2a0 > > > > > bee0: 00000001 00000001 00000017 ffffe000 00000000 60000013 > > > > > c0e5a2a0 c0269470 > > > > > bf00: c09c9ed0 ea54bf5c 00000103 00000000 00000000 c0e0a408 > > > > > ea537280 0000000e > > > > > bf20: 00000400 c0426500 00000000 eb04de08 ea4f71a8 c02694f4 > > > > > c09c9ed0 ea54bf5c > > > > > bf40: ea54bf28 c02699d0 ea54bf5c dd6cd422 ea537200 dd6cd422 > > > > > c09c9ed0 ea537200 > > > > > bf60: ea4af1c0 ea54a000 ea537200 c0426500 00000000 eb04de08 > > > > > ea4f71a8 c0426524 > > > > > bf80: ea4f7180 c023dcec ea54a000 ea4af1c0 c023dbb4 00000000 > > > > > 00000000 00000000 > > > > > bfa0: 00000000 00000000 00000000 c02010d8 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 > > > > > 00000000 00000000 > > > > > [] (usercopy_abort) from [] > > > > > (__check_object_size+0x2d8/0x448) > > > > > [] (__check_object_size) from [] > > > > > (build_test_sglist+0x268/0x2d8) > > > > > [] (build_test_sglist) from [] > > > > > (test_hash_vec_cfg+0x110/0x694) > > > > > [] (test_hash_vec_cfg) from [] > > > > > (__alg_test_hash+0x158/0x1b8) > > > > > [] (__alg_test_hash) from [] (alg_test_hash+0xac/0xf4) > > > > > [] (alg_test_hash) from [] (alg_test.part.4+0x264/0x2f8) > > > > > [] (alg_test.part.4) from [] (cryptomgr_test+0x24/0x44) > > > > > [] (cryptomgr_test) from [] (kthread+0x138/0x150) > > > > > [] (kthread) from [] (ret_from_fork+0x14/0x3c) > > > > > Exception stack(0xea54bfb0 to 0xea54bff8) > > > > > bfa0: 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 > > > > > Code: e58de000 e98d0012 e1a0100c ebfd6712 (e7f001f2) > > > > > ---[ end trace 190b3cf48e720f78 ]--- > > > > > BUG: sleeping function called from invalid context at > > > > > include/linux/percpu-rwsem.h:34 > > > > > in_atomic(): 0, irqs_disabled(): 128, pid: 35, name: cryptomgr_test > > > > > CPU: 0 PID: 35 Comm: cryptomgr_test Tainted: G D > > > > > 5.1.0-rc1-koelsch-01109-gbeb7d6376ecfbf07-dirty #397 > > > > > Hardware name: Generic R-Car Gen2 (Flattened Device Tree) > > > > > [] (unwind_backtrace) from [] (show_stack+0x10/0x14) > > > > > [] (show_stack) from [] (dump_stack+0x7c/0x9c) > > > > > [] (dump_stack) from [] (___might_sleep+0xf4/0x158) > > > > > [] (___might_sleep) from [] (exit_signals+0x2c/0x258) > > > > > [] (exit_signals) from [] (do_exit+0x114/0xa20) > > > > > [] (do_exit) from [] (die+0x304/0x344) > > > > > [] (die) from [] (do_undefinstr+0x80/0x190) > > > > > [] (do_undefinstr) from [] (__und_svc_finish+0x0/0x3c) > > > > > Exception stack(0xea54bc10 to 0xea54bc58) > > > > > bc00: 0000005f 2abb4000 > > > > > dd6cd422 dd6cd422 > > > > > bc20: c09d1120 0000002a 00000000 ea54d00a ea54d009 c0e0ce04 > > > > > 00000000 cccccccd > > > > > bc40: 00000010 ea54bc60 c030fd60 c030fd60 60000013 ffffffff > > > > > [] (__und_svc_finish) from [] (usercopy_abort+0x68/0x90) > > > > > [] (usercopy_abort) from [] > > > > > (__check_object_size+0x2d8/0x448) > > > > > [] (__check_object_size) from [] > > > > > (build_test_sglist+0x268/0x2d8) > > > > > [] (build_test_sglist) from [] > > > > > (test_hash_vec_cfg+0x110/0x694) > > > > > [] (test_hash_vec_cfg) from [] > > > > > (__alg_test_hash+0x158/0x1b8) > > > > > [] (__alg_test_hash) from [] (alg_test_hash+0xac/0xf4) > > > > > [] (alg_test_hash) from [] (alg_test.part.4+0x264/0x2f8) > > > > > [] (alg_test.part.4) from [] (cryptomgr_test+0x24/0x44) > > > > > [] (cryptomgr_test) from [] (kthread+0x138/0x150) > > > > > [] (kthread) from [] (ret_from_fork+0x14/0x3c) > > > > > Exception stack(0xea54bfb0 to 0xea54bff8) > > > > > bfa0: 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 > > > > > > > > > > > > > Well, this must happen with the new (in 5.1) crypto self-tests implementation > > > > for any crypto algorithm when CONFIG_HARDENED_USERCOPY_PAGESPAN=y. I don't > > > > understand why hardened usercopy considers it a bug though, as there's no buffer > > > > overflow. The crypto tests use copy_from_iter() to copy data into a 2-page > > > > buffer that was allocated with __get_free_pages(): > > > > > > > > __get_free_pages(GFP_KERNEL, 1) > > > > > > > > ... where 1 means an order-1 allocation. > > > > > > > > If it copies to offset=4064 len=42, for example, then hardened usercopy > > > > considers it a bug even though the buffer is 8192 bytes long. Why? > > > > > > > > It isn't actually copying anything to/from userspace, BTW; it's using iov_iter > > > > with ITER_KVEC. > > > > > > > > - Eric > > > > > > Kees, any thoughts on why hardened usercopy rejects copies spanning a page > > > boundary when they seem to be fine? > > > > This is due to missing the compound page marking, if I remember > > correctly. However, I tend to leave the pagespan test disabled: it > > really isn't ready for production use -- there are a lot of missing > > annotations still. > > > > So do I need to add __GFP_COMP? Is there any actual reason to do so? > Why does hardened usercopy check for it? > > - Eric Hi Kees, any answer to this question? - Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.5 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED,USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95B06C10F0E for ; Wed, 10 Apr 2019 03:17:54 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 64EB120830 for ; Wed, 10 Apr 2019 03:17:54 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="q1DEUFZN"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="cd4RAQOt" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 64EB120830 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=cTfRWMFzNhwKMCX8IerRmoYebKszRqz/6TQhbdX0A+A=; b=q1DEUFZNDzW+td EPhrC4Ex0nS7TyIIqZ6QtRHSoew69I0sxuR3Q1PUVR2IesG780jF9lE3Pirf1TJCL7CAz1OMpVG0O OrFNcXIivnHBz1fonn6S5p5NWTtxlcaNNqVc6OWYqqoVZ2UOiTCurh5wVlcPsF8uAMoLTm648Eo1j uYI04XrJrhkBMmxb70CfzAS6fRxOH620vL+/IXhiT0X8uUu+lKIlSTv1RQ1WcCDCVJM/3VaghloKT 44OKh8mUYdS31EzLiu7jq60Wm/MnnTsbMiwRjioNcQ+O4NmspIf56Hk5qGSeExzoNkrj+gz0JAs02 /8NKXikjfIig6G+nTZQg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hE3k7-0003ZQ-R0; Wed, 10 Apr 2019 03:17:43 +0000 Received: from mail.kernel.org ([198.145.29.99]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1hE3k4-0003Z7-5H for linux-arm-kernel@lists.infradead.org; Wed, 10 Apr 2019 03:17:42 +0000 Received: from sol.localdomain (c-24-5-143-220.hsd1.ca.comcast.net [24.5.143.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 32FFD20830; Wed, 10 Apr 2019 03:17:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554866257; bh=1TZla5zsJoJ+Fk7s4RQax79cQhIzJ6KroNbI+HWS29o=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=cd4RAQOtwzQ5PoT3sGqUnAge//I834uXVYwGlXTYi3sb7PWEnFuE3NZr1NDVrm29Y CY2AG2eA2bJZ4bNW3u7p050Wvja7UZtUVYkSNZUZIrcB0TIhbhP6q3DpdAIrfFxeKW kdhlE6SKZT3P5Pz671MZj0NJwREmr+eQlY6AfZTE= Date: Tue, 9 Apr 2019 20:17:35 -0700 From: Eric Biggers To: Kees Cook Subject: Re: crypto: Kernel memory overwrite attempt detected to spans multiple pages Message-ID: <20190410031734.GB7140@sol.localdomain> References: <20190319170911.GB202956@gmail.com> <20190320185719.GB180195@gmail.com> <20190321175122.GA1587@sol.localdomain> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20190321175122.GA1587@sol.localdomain> User-Agent: Mutt/1.11.4 (2019-03-13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190409_201740_237774_3EA9E926 X-CRM114-Status: GOOD ( 25.27 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Herbert Xu , Linux Kernel Mailing List , linux-security-module , Geert Uytterhoeven , Linux Crypto Mailing List , Linux ARM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, Mar 21, 2019 at 10:51:22AM -0700, Eric Biggers wrote: > On Thu, Mar 21, 2019 at 10:45:31AM -0700, Kees Cook wrote: > > On Wed, Mar 20, 2019 at 11:57 AM Eric Biggers wrote: > > > > > > On Tue, Mar 19, 2019 at 10:09:13AM -0700, Eric Biggers wrote: > > > > On Tue, Mar 19, 2019 at 12:54:23PM +0100, Geert Uytterhoeven wrote: > > > > > When running the sha1-asm crypto selftest on arm with > > > > > CONFIG_HARDENED_USERCOPY_PAGESPAN=y: > > > > > > > > > > usercopy: Kernel memory overwrite attempt detected to spans > > > > > multiple pages (offset 0, size 42)! > > > > > ------------[ cut here ]------------ > > > > > kernel BUG at mm/usercopy.c:102! > > > > > Internal error: Oops - BUG: 0 [#1] SMP ARM > > > > > Modules linked in: > > > > > CPU: 0 PID: 35 Comm: cryptomgr_test Not tainted > > > > > 5.1.0-rc1-koelsch-01109-gbeb7d6376ecfbf07-dirty #397 > > > > > Hardware name: Generic R-Car Gen2 (Flattened Device Tree) > > > > > PC is at usercopy_abort+0x68/0x90 > > > > > LR is at usercopy_abort+0x68/0x90 > > > > > pc : [] lr : [] psr: 60000013 > > > > > sp : ea54bc60 ip : 00000010 fp : cccccccd > > > > > r10: 00000000 r9 : c0e0ce04 r8 : ea54d009 > > > > > r7 : ea54d00a r6 : 00000000 r5 : 0000002a r4 : c09d1120 > > > > > r3 : dd6cd422 r2 : dd6cd422 r1 : 2abb4000 r0 : 0000005f > > > > > Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user > > > > > Control: 30c5387d Table: 40003000 DAC: fffffffd > > > > > Process cryptomgr_test (pid: 35, stack limit = 0x(ptrval)) > > > > > Stack: (0xea54bc60 to 0xea54c000) > > > > > bc60: c09d1120 c09d1120 c09d1120 00000000 0000002a 0000002a > > > > > 00000000 c0310060 > > > > > bc80: 0000002a 00000000 000001c0 00000000 00000000 c0eb11e8 > > > > > ea54cfe0 ea538c00 > > > > > bca0: 00000000 ea54cfe0 ebef73e0 0000002a ea538c20 ea54bd84 > > > > > 0000003a c0427a30 > > > > > bcc0: ea54bdbc 00000000 00000000 c081cf70 eb074280 c081cf70 > > > > > 0000002a c081cf80 > > > > > bce0: 0000000e c07da138 ea54bd0c 00000000 c084061c c04248e8 > > > > > c0e0a408 eb074240 > > > > > bd00: eb074200 c04253c8 eb074280 ea550000 00000012 dd6cd422 > > > > > ebef7480 eb074200 > > > > > bd20: ea54bd84 c081cf64 ea537200 00000002 00000000 00000014 > > > > > c084061c c0428c38 > > > > > bd40: ea54bd84 ea54bdbc c081cd34 00000000 c0e4e4b4 ea538c40 > > > > > 00000002 eabe4e80 > > > > > bd60: ea538c00 00000400 ea4f7a00 ea4f7a60 eb074240 00000060 > > > > > 00000006 c09d544c > > > > > bd80: 00000038 00000003 00000000 00000038 ea54bd7c 00000001 > > > > > eb074200 00000000 > > > > > bda0: 00000000 dead4ead ffffffff ffffffff ea54bdb0 ea54bdb0 > > > > > 00000000 c081cf70 > > > > > bdc0: c081ce68 c081ce78 ea4f7480 eb000780 00000dc0 eb000780 > > > > > c0e4ee80 443e9884 > > > > > bde0: 6ed23b1c a14aaeba e52951f9 f17046e5 fefefefe fefefefe > > > > > fefefefe fefefefe > > > > > be00: eb000780 c04292c4 c0e0a638 60000013 60000013 c0305298 > > > > > ea4f7a00 c03062bc > > > > > be20: eb000780 00000cc0 ea4f7a00 dd6cd422 00000cc0 ea538c00 > > > > > 00000002 eabe4e40 > > > > > be40: ea537200 00000007 00000000 ea4f7a00 eb074200 c0429314 > > > > > eb074200 ea538c00 > > > > > be60: ea4f7a00 0000000a eabe4e80 c084061c c08405fc 00000006 > > > > > c04dace8 00000006 > > > > > be80: 00000000 c084065c ea537200 0000000e 00000400 eb04de08 > > > > > ea4f71a8 c0429420 > > > > > bea0: 00000400 ea537200 0000000e ea537200 0000000e c0429374 > > > > > 00000400 ffffffff > > > > > bec0: 000000a2 c042a414 00000103 c0e0a408 00000000 c0e0a438 > > > > > c0e5a2a0 c0e5a2a0 > > > > > bee0: 00000001 00000001 00000017 ffffe000 00000000 60000013 > > > > > c0e5a2a0 c0269470 > > > > > bf00: c09c9ed0 ea54bf5c 00000103 00000000 00000000 c0e0a408 > > > > > ea537280 0000000e > > > > > bf20: 00000400 c0426500 00000000 eb04de08 ea4f71a8 c02694f4 > > > > > c09c9ed0 ea54bf5c > > > > > bf40: ea54bf28 c02699d0 ea54bf5c dd6cd422 ea537200 dd6cd422 > > > > > c09c9ed0 ea537200 > > > > > bf60: ea4af1c0 ea54a000 ea537200 c0426500 00000000 eb04de08 > > > > > ea4f71a8 c0426524 > > > > > bf80: ea4f7180 c023dcec ea54a000 ea4af1c0 c023dbb4 00000000 > > > > > 00000000 00000000 > > > > > bfa0: 00000000 00000000 00000000 c02010d8 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 > > > > > 00000000 00000000 > > > > > [] (usercopy_abort) from [] > > > > > (__check_object_size+0x2d8/0x448) > > > > > [] (__check_object_size) from [] > > > > > (build_test_sglist+0x268/0x2d8) > > > > > [] (build_test_sglist) from [] > > > > > (test_hash_vec_cfg+0x110/0x694) > > > > > [] (test_hash_vec_cfg) from [] > > > > > (__alg_test_hash+0x158/0x1b8) > > > > > [] (__alg_test_hash) from [] (alg_test_hash+0xac/0xf4) > > > > > [] (alg_test_hash) from [] (alg_test.part.4+0x264/0x2f8) > > > > > [] (alg_test.part.4) from [] (cryptomgr_test+0x24/0x44) > > > > > [] (cryptomgr_test) from [] (kthread+0x138/0x150) > > > > > [] (kthread) from [] (ret_from_fork+0x14/0x3c) > > > > > Exception stack(0xea54bfb0 to 0xea54bff8) > > > > > bfa0: 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 > > > > > Code: e58de000 e98d0012 e1a0100c ebfd6712 (e7f001f2) > > > > > ---[ end trace 190b3cf48e720f78 ]--- > > > > > BUG: sleeping function called from invalid context at > > > > > include/linux/percpu-rwsem.h:34 > > > > > in_atomic(): 0, irqs_disabled(): 128, pid: 35, name: cryptomgr_test > > > > > CPU: 0 PID: 35 Comm: cryptomgr_test Tainted: G D > > > > > 5.1.0-rc1-koelsch-01109-gbeb7d6376ecfbf07-dirty #397 > > > > > Hardware name: Generic R-Car Gen2 (Flattened Device Tree) > > > > > [] (unwind_backtrace) from [] (show_stack+0x10/0x14) > > > > > [] (show_stack) from [] (dump_stack+0x7c/0x9c) > > > > > [] (dump_stack) from [] (___might_sleep+0xf4/0x158) > > > > > [] (___might_sleep) from [] (exit_signals+0x2c/0x258) > > > > > [] (exit_signals) from [] (do_exit+0x114/0xa20) > > > > > [] (do_exit) from [] (die+0x304/0x344) > > > > > [] (die) from [] (do_undefinstr+0x80/0x190) > > > > > [] (do_undefinstr) from [] (__und_svc_finish+0x0/0x3c) > > > > > Exception stack(0xea54bc10 to 0xea54bc58) > > > > > bc00: 0000005f 2abb4000 > > > > > dd6cd422 dd6cd422 > > > > > bc20: c09d1120 0000002a 00000000 ea54d00a ea54d009 c0e0ce04 > > > > > 00000000 cccccccd > > > > > bc40: 00000010 ea54bc60 c030fd60 c030fd60 60000013 ffffffff > > > > > [] (__und_svc_finish) from [] (usercopy_abort+0x68/0x90) > > > > > [] (usercopy_abort) from [] > > > > > (__check_object_size+0x2d8/0x448) > > > > > [] (__check_object_size) from [] > > > > > (build_test_sglist+0x268/0x2d8) > > > > > [] (build_test_sglist) from [] > > > > > (test_hash_vec_cfg+0x110/0x694) > > > > > [] (test_hash_vec_cfg) from [] > > > > > (__alg_test_hash+0x158/0x1b8) > > > > > [] (__alg_test_hash) from [] (alg_test_hash+0xac/0xf4) > > > > > [] (alg_test_hash) from [] (alg_test.part.4+0x264/0x2f8) > > > > > [] (alg_test.part.4) from [] (cryptomgr_test+0x24/0x44) > > > > > [] (cryptomgr_test) from [] (kthread+0x138/0x150) > > > > > [] (kthread) from [] (ret_from_fork+0x14/0x3c) > > > > > Exception stack(0xea54bfb0 to 0xea54bff8) > > > > > bfa0: 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 > > > > > 00000000 00000000 > > > > > bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 > > > > > > > > > > > > > Well, this must happen with the new (in 5.1) crypto self-tests implementation > > > > for any crypto algorithm when CONFIG_HARDENED_USERCOPY_PAGESPAN=y. I don't > > > > understand why hardened usercopy considers it a bug though, as there's no buffer > > > > overflow. The crypto tests use copy_from_iter() to copy data into a 2-page > > > > buffer that was allocated with __get_free_pages(): > > > > > > > > __get_free_pages(GFP_KERNEL, 1) > > > > > > > > ... where 1 means an order-1 allocation. > > > > > > > > If it copies to offset=4064 len=42, for example, then hardened usercopy > > > > considers it a bug even though the buffer is 8192 bytes long. Why? > > > > > > > > It isn't actually copying anything to/from userspace, BTW; it's using iov_iter > > > > with ITER_KVEC. > > > > > > > > - Eric > > > > > > Kees, any thoughts on why hardened usercopy rejects copies spanning a page > > > boundary when they seem to be fine? > > > > This is due to missing the compound page marking, if I remember > > correctly. However, I tend to leave the pagespan test disabled: it > > really isn't ready for production use -- there are a lot of missing > > annotations still. > > > > So do I need to add __GFP_COMP? Is there any actual reason to do so? > Why does hardened usercopy check for it? > > - Eric Hi Kees, any answer to this question? - Eric _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel