All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] x86: avoid VLA in pgd_alloc()
@ 2018-10-05 16:13 Arnd Bergmann
  2018-10-05 16:24 ` [tip:x86/urgent] x86/mm: Avoid " tip-bot for Arnd Bergmann
  0 siblings, 1 reply; 9+ messages in thread
From: Arnd Bergmann @ 2018-10-05 16:13 UTC (permalink / raw)
  To: Dave Hansen, Andy Lutomirski, Peter Zijlstra, Thomas Gleixner,
	Ingo Molnar, Borislav Petkov, x86
  Cc: Kees Cook, Arnd Bergmann, H. Peter Anvin, Toshi Kani,
	Andrew Morton, Joerg Roedel, linux-kernel

Turning on -Wvla found a new VLA usage:

In file included from include/linux/kernel.h:15,
                 from include/asm-generic/bug.h:18,
                 from arch/x86/include/asm/bug.h:83,
                 from include/linux/bug.h:5,
                 from include/linux/mmdebug.h:5,
                 from include/linux/mm.h:9,
                 from arch/x86/mm/pgtable.c:2:
arch/x86/mm/pgtable.c: In function 'pgd_alloc':
include/linux/build_bug.h:29:45: error: ISO C90 forbids variable length array 'u_pmds' [-Werror=vla]
arch/x86/mm/pgtable.c:190:34: note: in expansion of macro 'static_cpu_has'
 #define PREALLOCATED_USER_PMDS  (static_cpu_has(X86_FEATURE_PTI) ? \
                                  ^~~~~~~~~~~~~~
arch/x86/mm/pgtable.c:431:16: note: in expansion of macro 'PREALLOCATED_USER_PMDS'
  pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
                ^~~~~~~~~~~~~~~~~~~~~~

Use the actual size of the array that is used for X86_FEATURE_PTI
instead of the variable size.

Fixes: f59dbe9ca670 ("x86/pgtable/pae: Use separate kernel PMDs for user page-table")
Fixes: 68664695ae57 ("Makefile: Globally enable VLA warning")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 arch/x86/mm/pgtable.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 089e78c4effd..386b43e3e0ac 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -189,6 +189,7 @@ static void pgd_dtor(pgd_t *pgd)
  */
 #define PREALLOCATED_USER_PMDS	 (static_cpu_has(X86_FEATURE_PTI) ? \
 					KERNEL_PGD_PTRS : 0)
+#define MAX_PREALLOCATED_USER_PMDS KERNEL_PGD_PTRS
 
 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 {
@@ -211,6 +212,7 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 /* No need to prepopulate any pagetable entries in non-PAE modes. */
 #define PREALLOCATED_PMDS	0
 #define PREALLOCATED_USER_PMDS	 0
+#define MAX_PREALLOCATED_USER_PMDS 0
 #endif	/* CONFIG_X86_PAE */
 
 static void free_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
@@ -428,8 +430,8 @@ static inline void _pgd_free(pgd_t *pgd)
 pgd_t *pgd_alloc(struct mm_struct *mm)
 {
 	pgd_t *pgd;
-	pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
-	pmd_t *pmds[PREALLOCATED_PMDS];
+	pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS];
+	pmd_t *pmds[MAX_PREALLOCATED_USER_PMDS];
 
 	pgd = _pgd_alloc();
 
-- 
2.18.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread
* [PATCH] x86/mm: Fix preallocated PMD stack array
@ 2018-10-08 23:54 Kees Cook
  2018-10-09  7:03 ` [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc() tip-bot for Kees Cook
  0 siblings, 1 reply; 9+ messages in thread
From: Kees Cook @ 2018-10-08 23:54 UTC (permalink / raw)
  To: Ingo Molnar
  Cc: Borislav Petkov, Arnd Bergmann, Andrew Morton, Andy Lutomirski,
	Dave Hansen, Joerg Roedel, Linus Torvalds, Peter Zijlstra,
	Thomas Gleixner, Toshi Kani, linux-kernel

While trying to remove VLAs in pgd_alloc(), a typo was made and a use
of PREALLOCATED_PMDS was replaced with the new MAX_PREALLOCATED_USER_PMDS
(note "...USER..."). Instead, we also need a new MAX_PREALLOCATED_PMDS.
This adds it and fixes the stack array size.

Without this fix, 32-bit kernels would trip the stack protector at boot:

Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0
CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         4.19.0-rc6+ #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
Call Trace:
 dump_stack+0x66/0x95
 panic+0x94/0x1dd
 __stack_chk_fail+0x1e/0x20
 ? pgd_alloc+0x29e/0x2a0
 pgd_alloc+0x29e/0x2a0
 mm_init.isra.60+0x1ec/0x210
 mm_alloc+0x30/0x40
 __do_execve_file+0x378/0x930
 ? __do_execve_file+0x108/0x930
 ? kmem_cache_alloc+0x123/0x220
 do_execve+0x2c/0x30
 run_init_process+0x31/0x36
 ? rest_init+0xb0/0xb0
 try_to_run_init_process+0x11/0x33
 ? rest_init+0xb0/0xb0
 kernel_init+0x9e/0xda
 ret_from_fork+0x2e/0x38
Kernel Offset: disabled
---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0 ]---

Reported-by: Borislav Petkov <bp@alien8.de>
Fixes: 1be3f247c288 ("x86/mm: Avoid VLA in pgd_alloc()")
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 arch/x86/mm/pgtable.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 386b43e3e0ac..59274e2c1ac4 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -115,6 +115,8 @@ static inline void pgd_list_del(pgd_t *pgd)
 
 #define UNSHARED_PTRS_PER_PGD				\
 	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+#define MAX_UNSHARED_PTRS_PER_PGD			\
+	max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD)
 
 
 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
@@ -181,6 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
  * and initialize the kernel pmds here.
  */
 #define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
+#define MAX_PREALLOCATED_PMDS	MAX_UNSHARED_PTRS_PER_PGD
 
 /*
  * We allocate separate PMDs for the kernel part of the user page-table
@@ -211,6 +214,7 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 
 /* No need to prepopulate any pagetable entries in non-PAE modes. */
 #define PREALLOCATED_PMDS	0
+#define MAX_PREALLOCATED_PMDS	0
 #define PREALLOCATED_USER_PMDS	 0
 #define MAX_PREALLOCATED_USER_PMDS 0
 #endif	/* CONFIG_X86_PAE */
@@ -431,7 +435,7 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
 {
 	pgd_t *pgd;
 	pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS];
-	pmd_t *pmds[MAX_PREALLOCATED_USER_PMDS];
+	pmd_t *pmds[MAX_PREALLOCATED_PMDS];
 
 	pgd = _pgd_alloc();
 
-- 
2.17.1


-- 
Kees Cook
Pixel Security

^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2018-10-09  7:58 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-05 16:13 [PATCH] x86: avoid VLA in pgd_alloc() Arnd Bergmann
2018-10-05 16:24 ` [tip:x86/urgent] x86/mm: Avoid " tip-bot for Arnd Bergmann
2018-10-08 20:22   ` Borislav Petkov
2018-10-08 23:28     ` Kees Cook
2018-10-09  7:33       ` Arnd Bergmann
2018-10-09  7:39         ` Joerg Roedel
2018-10-09  7:48           ` Ingo Molnar
2018-10-08 23:54 [PATCH] x86/mm: Fix preallocated PMD stack array Kees Cook
2018-10-09  7:03 ` [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc() tip-bot for Kees Cook
2018-10-09  7:58   ` Arnd Bergmann

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.