Linux-RISC-V Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] riscv: Fixup bootup failure with HARDENED_USERCOPY
@ 2020-10-06 16:49 guoren
  2020-10-07  4:12 ` Palmer Dabbelt
  0 siblings, 1 reply; 3+ messages in thread
From: guoren @ 2020-10-06 16:49 UTC (permalink / raw)
  To: palmerdabbelt
  Cc: linux-riscv, Guo Ren, Andreas Schwab, linux-kernel, Atish Patra

From: Guo Ren <guoren@linux.alibaba.com>

As Aurelien has reported:

[    3.484586] AppArmor: AppArmor sha1 policy hashing enabled
[    4.749835] Freeing unused kernel memory: 492K
[    4.752017] Run /init as init process
[    4.753571] usercopy: Kernel memory overwrite attempt detected to kernel text (offset 507879, size 11)!
[    4.754838] ------------[ cut here ]------------
[    4.755651] kernel BUG at mm/usercopy.c:99!
[    4.756445] Kernel BUG [#1]
[    4.756815] Modules linked in:
[    4.757542] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.8.0-1-riscv64 #1 Debian 5.8.7-1
[    4.758372] epc: ffffffe0003b5120 ra : ffffffe0003b5120 sp : ffffffe07f783ca0
[    4.758960]  gp : ffffffe000cc7230 tp : ffffffe07f77cec0 t0 : ffffffe000cdafc0
[    4.759772]  t1 : 0000000000000064 t2 : 0000000000000000 s0 : ffffffe07f783cf0
[    4.760534]  s1 : ffffffe00095d780 a0 : 000000000000005b a1 : 0000000000000020
[    4.761309]  a2 : 0000000000000005 a3 : 0000000000000000 a4 : ffffffe000c1f340
[    4.761848]  a5 : ffffffe000c1f340 a6 : 0000000000000000 a7 : 0000000000000087
[    4.762684]  s2 : ffffffe000941848 s3 : 000000000007bfe7 s4 : 000000000000000b
[    4.763500]  s5 : 0000000000000000 s6 : ffffffe00091cc00 s7 : fffffffffffff000
[    4.764376]  s8 : 0000003ffffff000 s9 : ffffffe0769f3200 s10: 000000000000000b
[    4.765208]  s11: ffffffe07d548c40 t3 : 0000000000000000 t4 : 000000000001dcd0
[    4.766059]  t5 : ffffffe000cc8510 t6 : ffffffe000cd64aa
[    4.766712] status: 0000000000000120 badaddr: 0000000000000000 cause: 0000000000000003
[    4.768308] ---[ end trace 1f8e733e834d4c3e ]---
[    4.769129] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[    4.770070] SMP: stopping secondary CPUs
[    4.771110] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

Above failure is relate to commit: a0fa4027dc911 (riscv: Fixup
static_obj() fail). When we expand static_obj include INIT_DATA,
we also include INIT_TEXT into usercopy check kernel text:

/* Is this address range in the kernel text area? */
static inline void check_kernel_text_object(const unsigned long ptr,
                                            unsigned long n, bool to_user)
{
        unsigned long textlow = (unsigned long)_stext;
        unsigned long texthigh = (unsigned long)_etext;
        unsigned long textlow_linear, texthigh_linear;

        if (overlaps(ptr, n, textlow, texthigh))
                usercopy_abort("kernel text", NULL, to_user, ptr - textlow, n);

When INIT_TEXT/DATA are freed, new allocation will reuse these
memory and overlaps check will be triggered.

The patch met static_obj and check_kernel_text_object requirements.

Link: https://lore.kernel.org/linux-riscv/1593266228-61125-1-git-send-email-guoren@kernel.org/T/#t
Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Tested-by: Aurelien Jarno <aurelien@aurel32.net>
Cc: Palmer Dabbelt <palmerdabbelt@google.com>
Cc: Atish Patra <atishp@atishpatra.org>
Cc: Andreas Schwab <schwab@linux-m68k.org>
---
 arch/riscv/kernel/vmlinux.lds.S | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index f3586e3..34d00d9 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -22,13 +22,11 @@ SECTIONS
 	/* Beginning of code and text segment */
 	. = LOAD_OFFSET;
 	_start = .;
-	_stext = .;
 	HEAD_TEXT_SECTION
 	. = ALIGN(PAGE_SIZE);
 
 	__init_begin = .;
 	INIT_TEXT_SECTION(PAGE_SIZE)
-	INIT_DATA_SECTION(16)
 	. = ALIGN(8);
 	__soc_early_init_table : {
 		__soc_early_init_table_start = .;
@@ -55,6 +53,7 @@ SECTIONS
 	. = ALIGN(SECTION_ALIGN);
 	.text : {
 		_text = .;
+		_stext = .;
 		TEXT_TEXT
 		SCHED_TEXT
 		CPUIDLE_TEXT
@@ -67,6 +66,8 @@ SECTIONS
 		_etext = .;
 	}
 
+	INIT_DATA_SECTION(16)
+
 	/* Start of data section */
 	_sdata = .;
 	RO_DATA(SECTION_ALIGN)
-- 
2.7.4


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] riscv: Fixup bootup failure with HARDENED_USERCOPY
  2020-10-06 16:49 [PATCH] riscv: Fixup bootup failure with HARDENED_USERCOPY guoren
@ 2020-10-07  4:12 ` Palmer Dabbelt
  2020-10-07  7:12   ` Atish Patra
  0 siblings, 1 reply; 3+ messages in thread
From: Palmer Dabbelt @ 2020-10-07  4:12 UTC (permalink / raw)
  To: guoren; +Cc: linux-riscv, guoren, schwab, linux-kernel, atishp

On Tue, 06 Oct 2020 09:49:33 PDT (-0700), guoren@kernel.org wrote:
> From: Guo Ren <guoren@linux.alibaba.com>
>
> As Aurelien has reported:
>
> [    3.484586] AppArmor: AppArmor sha1 policy hashing enabled
> [    4.749835] Freeing unused kernel memory: 492K
> [    4.752017] Run /init as init process
> [    4.753571] usercopy: Kernel memory overwrite attempt detected to kernel text (offset 507879, size 11)!
> [    4.754838] ------------[ cut here ]------------
> [    4.755651] kernel BUG at mm/usercopy.c:99!
> [    4.756445] Kernel BUG [#1]
> [    4.756815] Modules linked in:
> [    4.757542] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.8.0-1-riscv64 #1 Debian 5.8.7-1
> [    4.758372] epc: ffffffe0003b5120 ra : ffffffe0003b5120 sp : ffffffe07f783ca0
> [    4.758960]  gp : ffffffe000cc7230 tp : ffffffe07f77cec0 t0 : ffffffe000cdafc0
> [    4.759772]  t1 : 0000000000000064 t2 : 0000000000000000 s0 : ffffffe07f783cf0
> [    4.760534]  s1 : ffffffe00095d780 a0 : 000000000000005b a1 : 0000000000000020
> [    4.761309]  a2 : 0000000000000005 a3 : 0000000000000000 a4 : ffffffe000c1f340
> [    4.761848]  a5 : ffffffe000c1f340 a6 : 0000000000000000 a7 : 0000000000000087
> [    4.762684]  s2 : ffffffe000941848 s3 : 000000000007bfe7 s4 : 000000000000000b
> [    4.763500]  s5 : 0000000000000000 s6 : ffffffe00091cc00 s7 : fffffffffffff000
> [    4.764376]  s8 : 0000003ffffff000 s9 : ffffffe0769f3200 s10: 000000000000000b
> [    4.765208]  s11: ffffffe07d548c40 t3 : 0000000000000000 t4 : 000000000001dcd0
> [    4.766059]  t5 : ffffffe000cc8510 t6 : ffffffe000cd64aa
> [    4.766712] status: 0000000000000120 badaddr: 0000000000000000 cause: 0000000000000003
> [    4.768308] ---[ end trace 1f8e733e834d4c3e ]---
> [    4.769129] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
> [    4.770070] SMP: stopping secondary CPUs
> [    4.771110] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
>
> Above failure is relate to commit: a0fa4027dc911 (riscv: Fixup

That commit isn't in Linus' tree (at least, as far as I see it).  I have
6184358da000 ("riscv: Fixup static_obj() fail"), so I'm going to fix that -- in
fact, I'm going to essentially just replace most of this rationale with what I
wrote up in my revert as this is all a bit too long for a commit message.

I was kind of worried the initdata move was a bit too risky, but after reading
the users of __init_{begin,end} I think it's safe.  Here's what I ended up with
on fixes.

Thanks!

commit 84814460eef9af0fb56a4698341c9cb7996a6312 (HEAD -> fixes, riscv/fixes)
gpg: Signature made Tue 06 Oct 2020 09:11:35 PM PDT
gpg:                using RSA key 2B3C3747446843B24A943A7A2E1319F35FBB1889
gpg:                issuer "palmer@dabbelt.com"
gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>" [ultimate]
gpg:                 aka "Palmer Dabbelt <palmerdabbelt@google.com>" [ultimate]
Author: Guo Ren <guoren@linux.alibaba.com>
Date:   Tue Oct 6 16:49:33 2020 +0000

    riscv: Fixup bootup failure with HARDENED_USERCOPY
    
    6184358da000 ("riscv: Fixup static_obj() fail") attempted to elide a lockdep
    failure by rearranging our kernel image to place all initdata within [_stext,
    _end], thus triggering lockdep to treat these as static objects.  These objects
    are released and eventually reallocated, causing check_kernel_text_object() to
    trigger a BUG().
    
    This backs out the change to make [_stext, _end] all-encompassing, instead just
    moving initdata.  This results in initdata being outside of [__init_begin,
    __init_end], which means initdata can't be freed.
    
    Link: https://lore.kernel.org/linux-riscv/1593266228-61125-1-git-send-email-guoren@kernel.org/T/#t
    Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
    Reported-by: Aurelien Jarno <aurelien@aurel32.net>
    Tested-by: Aurelien Jarno <aurelien@aurel32.net>
    [Palmer: Clean up commit text]
    Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>

> static_obj() fail). When we expand static_obj include INIT_DATA,
> we also include INIT_TEXT into usercopy check kernel text:
>
> /* Is this address range in the kernel text area? */
> static inline void check_kernel_text_object(const unsigned long ptr,
>                                             unsigned long n, bool to_user)
> {
>         unsigned long textlow = (unsigned long)_stext;
>         unsigned long texthigh = (unsigned long)_etext;
>         unsigned long textlow_linear, texthigh_linear;
>
>         if (overlaps(ptr, n, textlow, texthigh))
>                 usercopy_abort("kernel text", NULL, to_user, ptr - textlow, n);
>
> When INIT_TEXT/DATA are freed, new allocation will reuse these
> memory and overlaps check will be triggered.
>
> The patch met static_obj and check_kernel_text_object requirements.
>
> Link: https://lore.kernel.org/linux-riscv/1593266228-61125-1-git-send-email-guoren@kernel.org/T/#t
> Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
> Reported-by: Aurelien Jarno <aurelien@aurel32.net>
> Tested-by: Aurelien Jarno <aurelien@aurel32.net>
> Cc: Palmer Dabbelt <palmerdabbelt@google.com>
> Cc: Atish Patra <atishp@atishpatra.org>
> Cc: Andreas Schwab <schwab@linux-m68k.org>
> ---
>  arch/riscv/kernel/vmlinux.lds.S | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
> index f3586e3..34d00d9 100644
> --- a/arch/riscv/kernel/vmlinux.lds.S
> +++ b/arch/riscv/kernel/vmlinux.lds.S
> @@ -22,13 +22,11 @@ SECTIONS
>  	/* Beginning of code and text segment */
>  	. = LOAD_OFFSET;
>  	_start = .;
> -	_stext = .;
>  	HEAD_TEXT_SECTION
>  	. = ALIGN(PAGE_SIZE);
>
>  	__init_begin = .;
>  	INIT_TEXT_SECTION(PAGE_SIZE)
> -	INIT_DATA_SECTION(16)
>  	. = ALIGN(8);
>  	__soc_early_init_table : {
>  		__soc_early_init_table_start = .;
> @@ -55,6 +53,7 @@ SECTIONS
>  	. = ALIGN(SECTION_ALIGN);
>  	.text : {
>  		_text = .;
> +		_stext = .;
>  		TEXT_TEXT
>  		SCHED_TEXT
>  		CPUIDLE_TEXT
> @@ -67,6 +66,8 @@ SECTIONS
>  		_etext = .;
>  	}
>
> +	INIT_DATA_SECTION(16)
> +
>  	/* Start of data section */
>  	_sdata = .;
>  	RO_DATA(SECTION_ALIGN)

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] riscv: Fixup bootup failure with HARDENED_USERCOPY
  2020-10-07  4:12 ` Palmer Dabbelt
@ 2020-10-07  7:12   ` Atish Patra
  0 siblings, 0 replies; 3+ messages in thread
From: Atish Patra @ 2020-10-07  7:12 UTC (permalink / raw)
  To: Palmer Dabbelt
  Cc: Andreas Schwab, linux-riscv, Guo Ren, Guo Ren,
	linux-kernel@vger.kernel.org List

On Tue, Oct 6, 2020 at 9:12 PM Palmer Dabbelt <palmerdabbelt@google.com> wrote:
>
> On Tue, 06 Oct 2020 09:49:33 PDT (-0700), guoren@kernel.org wrote:
> > From: Guo Ren <guoren@linux.alibaba.com>
> >
> > As Aurelien has reported:
> >
> > [    3.484586] AppArmor: AppArmor sha1 policy hashing enabled
> > [    4.749835] Freeing unused kernel memory: 492K
> > [    4.752017] Run /init as init process
> > [    4.753571] usercopy: Kernel memory overwrite attempt detected to kernel text (offset 507879, size 11)!
> > [    4.754838] ------------[ cut here ]------------
> > [    4.755651] kernel BUG at mm/usercopy.c:99!
> > [    4.756445] Kernel BUG [#1]
> > [    4.756815] Modules linked in:
> > [    4.757542] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.8.0-1-riscv64 #1 Debian 5.8.7-1
> > [    4.758372] epc: ffffffe0003b5120 ra : ffffffe0003b5120 sp : ffffffe07f783ca0
> > [    4.758960]  gp : ffffffe000cc7230 tp : ffffffe07f77cec0 t0 : ffffffe000cdafc0
> > [    4.759772]  t1 : 0000000000000064 t2 : 0000000000000000 s0 : ffffffe07f783cf0
> > [    4.760534]  s1 : ffffffe00095d780 a0 : 000000000000005b a1 : 0000000000000020
> > [    4.761309]  a2 : 0000000000000005 a3 : 0000000000000000 a4 : ffffffe000c1f340
> > [    4.761848]  a5 : ffffffe000c1f340 a6 : 0000000000000000 a7 : 0000000000000087
> > [    4.762684]  s2 : ffffffe000941848 s3 : 000000000007bfe7 s4 : 000000000000000b
> > [    4.763500]  s5 : 0000000000000000 s6 : ffffffe00091cc00 s7 : fffffffffffff000
> > [    4.764376]  s8 : 0000003ffffff000 s9 : ffffffe0769f3200 s10: 000000000000000b
> > [    4.765208]  s11: ffffffe07d548c40 t3 : 0000000000000000 t4 : 000000000001dcd0
> > [    4.766059]  t5 : ffffffe000cc8510 t6 : ffffffe000cd64aa
> > [    4.766712] status: 0000000000000120 badaddr: 0000000000000000 cause: 0000000000000003
> > [    4.768308] ---[ end trace 1f8e733e834d4c3e ]---
> > [    4.769129] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
> > [    4.770070] SMP: stopping secondary CPUs
> > [    4.771110] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
> >
> > Above failure is relate to commit: a0fa4027dc911 (riscv: Fixup
>
> That commit isn't in Linus' tree (at least, as far as I see it).  I have
> 6184358da000 ("riscv: Fixup static_obj() fail"), so I'm going to fix that -- in
> fact, I'm going to essentially just replace most of this rationale with what I
> wrote up in my revert as this is all a bit too long for a commit message.
>
> I was kind of worried the initdata move was a bit too risky, but after reading
> the users of __init_{begin,end} I think it's safe.  Here's what I ended up with
> on fixes.
>
> Thanks!
>
> commit 84814460eef9af0fb56a4698341c9cb7996a6312 (HEAD -> fixes, riscv/fixes)
> gpg: Signature made Tue 06 Oct 2020 09:11:35 PM PDT
> gpg:                using RSA key 2B3C3747446843B24A943A7A2E1319F35FBB1889
> gpg:                issuer "palmer@dabbelt.com"
> gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>" [ultimate]
> gpg:                 aka "Palmer Dabbelt <palmerdabbelt@google.com>" [ultimate]
> Author: Guo Ren <guoren@linux.alibaba.com>
> Date:   Tue Oct 6 16:49:33 2020 +0000
>
>     riscv: Fixup bootup failure with HARDENED_USERCOPY
>
>     6184358da000 ("riscv: Fixup static_obj() fail") attempted to elide a lockdep
>     failure by rearranging our kernel image to place all initdata within [_stext,
>     _end], thus triggering lockdep to treat these as static objects.  These objects
>     are released and eventually reallocated, causing check_kernel_text_object() to
>     trigger a BUG().
>
>     This backs out the change to make [_stext, _end] all-encompassing, instead just
>     moving initdata.  This results in initdata being outside of [__init_begin,
>     __init_end], which means initdata can't be freed.
>

But we are not moving all initdata out of __init_begin/end. Should we
move all the _initdata section out of _init_begin ?
http://lists.infradead.org/pipermail/linux-riscv/2020-October/002400.html

>     Link: https://lore.kernel.org/linux-riscv/1593266228-61125-1-git-send-email-guoren@kernel.org/T/#t
>     Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
>     Reported-by: Aurelien Jarno <aurelien@aurel32.net>
>     Tested-by: Aurelien Jarno <aurelien@aurel32.net>
>     [Palmer: Clean up commit text]
>     Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
>
> > static_obj() fail). When we expand static_obj include INIT_DATA,
> > we also include INIT_TEXT into usercopy check kernel text:
> >
> > /* Is this address range in the kernel text area? */
> > static inline void check_kernel_text_object(const unsigned long ptr,
> >                                             unsigned long n, bool to_user)
> > {
> >         unsigned long textlow = (unsigned long)_stext;
> >         unsigned long texthigh = (unsigned long)_etext;
> >         unsigned long textlow_linear, texthigh_linear;
> >
> >         if (overlaps(ptr, n, textlow, texthigh))
> >                 usercopy_abort("kernel text", NULL, to_user, ptr - textlow, n);
> >
> > When INIT_TEXT/DATA are freed, new allocation will reuse these
> > memory and overlaps check will be triggered.
> >
> > The patch met static_obj and check_kernel_text_object requirements.
> >
> > Link: https://lore.kernel.org/linux-riscv/1593266228-61125-1-git-send-email-guoren@kernel.org/T/#t
> > Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
> > Reported-by: Aurelien Jarno <aurelien@aurel32.net>
> > Tested-by: Aurelien Jarno <aurelien@aurel32.net>
> > Cc: Palmer Dabbelt <palmerdabbelt@google.com>
> > Cc: Atish Patra <atishp@atishpatra.org>
> > Cc: Andreas Schwab <schwab@linux-m68k.org>
> > ---
> >  arch/riscv/kernel/vmlinux.lds.S | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
> > index f3586e3..34d00d9 100644
> > --- a/arch/riscv/kernel/vmlinux.lds.S
> > +++ b/arch/riscv/kernel/vmlinux.lds.S
> > @@ -22,13 +22,11 @@ SECTIONS
> >       /* Beginning of code and text segment */
> >       . = LOAD_OFFSET;
> >       _start = .;
> > -     _stext = .;
> >       HEAD_TEXT_SECTION
> >       . = ALIGN(PAGE_SIZE);
> >
> >       __init_begin = .;
> >       INIT_TEXT_SECTION(PAGE_SIZE)
> > -     INIT_DATA_SECTION(16)
> >       . = ALIGN(8);
> >       __soc_early_init_table : {
> >               __soc_early_init_table_start = .;
> > @@ -55,6 +53,7 @@ SECTIONS
> >       . = ALIGN(SECTION_ALIGN);
> >       .text : {
> >               _text = .;
> > +             _stext = .;
> >               TEXT_TEXT
> >               SCHED_TEXT
> >               CPUIDLE_TEXT
> > @@ -67,6 +66,8 @@ SECTIONS
> >               _etext = .;
> >       }
> >
> > +     INIT_DATA_SECTION(16)
> > +
> >       /* Start of data section */
> >       _sdata = .;
> >       RO_DATA(SECTION_ALIGN)



-- 
Regards,
Atish

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-06 16:49 [PATCH] riscv: Fixup bootup failure with HARDENED_USERCOPY guoren
2020-10-07  4:12 ` Palmer Dabbelt
2020-10-07  7:12   ` Atish Patra

Linux-RISC-V Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-riscv/0 linux-riscv/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-riscv linux-riscv/ https://lore.kernel.org/linux-riscv \
		linux-riscv@lists.infradead.org
	public-inbox-index linux-riscv

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.infradead.lists.linux-riscv


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git